Amazon Threat Intelligence identifies PHP2Shell exploitation previous to public disclosure in MadPot

Amazon Threat Intelligence recognized a PHP2Shell exploitation try relationship to Oct. 17, 2026, in MadPot telemetry, 4 days earlier than public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit try originated from an IP handle related to a business anonymization community. While the vulnerability was beneath embargo, the focusing on of a honeypot from an anonymized IP handle suggests the exercise was performed by a risk actor, although it stays unclear how the actor acquired exploit info previous to disclosure.

The PHP embargo window was set to be lifted on 2026-10-21 1400 UTC. On the day of the discharge, Amazon Threat Intelligence recognized a number of proof of idea exploits for the vulnerability, with the earliest round 2026-10-21 0200 UTC. Subsequently, from 2026-10-21 0200 UTC to 2026-10-21 0800 UTC, Amazon Threat Intelligence recognized extra exploitation makes an attempt of PHP2Shell focusing on MadPot from extra anonymized transport systems. The precise payloads and selections in anonymization transport systems various, suggesting these have been a number of actors. Technical evaluation is ongoing, and it’s unclear if any of those makes an attempt would have succeeded in real-world techniques.

The precise launch of the embargo window was 2026-10-21 1400 UTC. Once the embargo was lifted and the patch was launched, extra proof-of-concept exploits appeared inside hours, and we noticed them used in opposition to our sensors nearly instantly. PHP2Shell is now being broadly exploited within the wild.

Two classes from this occasion apply nicely past this one vulnerability:

1. An embargo protects defenders solely till another person finds the identical bug. Coordinated disclosure continues to be the suitable mannequin. But defenders mustn’t assume the general public disclosure date is the earliest date of exploitation. With PHP2Shell, compromise might predate the advisory.
2. The time from patch to working exploit is shrinking for structural causes. In the previous, most exploitation we noticed got here after a public proof of idea was launched. A small variety of succesful actors constructed exploits, and everybody else waited for them. That dependency is weakening. AI-assisted evaluation makes it cheaper to show a patch diff or advisory right into a working exploit. As a consequence, extra actors can act inside hours and even minutes as soon as technical particulars of a vulnerability are disclosed.

For safety leaders, this modifications a number of working assumptions:

1. For important vulnerabilities in internet-facing techniques, measure patch and mitigation timelines in hours. A 7-day or 30-day SLA assumes a delay that now not exists.
2. Start investigations from the earliest recognized exploitation, not from the disclosure date. For PHP2Shell, examine from no less than beginning on October 17^th.
3. Invest in detections that don’t depend on a signature for a selected CVE. The first exploitation will usually come earlier than these signatures exist.

AWS deploys a number of layers of safety to assist safeguard prospects. Our inner risk intelligence system mechanically detected and restricted malicious scanning makes an attempt focusing on this vulnerability. We analyze over 200 billion occasions per minute and combine risk intelligence from our MadPot honeypot community to determine and block recognized exploitation makes an attempt in actual time. Our honeypot system supplies us with early detection of exploitation makes an attempt, enabling speedy response and risk evaluation.

1. Upgrade instantly to the mounted PHP variations. Upgrading is the one full remediation for each CVE-2026-109618 and CVE-2026-109619. There aren’t any configuration-only workarounds that totally handle each points.
2. Consider blocking multi-part file uploads in PHP deployments that can not be patched instantly, however decide how this could have an effect on your software previous to deploying.
3. Look for POST requests with the PHP_SESSION_UPLOAD_PROGRESS string in type uploads.
4. Review internet server logs for suspicious exercise.
5. Check for surprising course of execution or file modification on internet software servers.