Amazon Threat Intelligence detects PHP2Shell exploitation four days before public disclosure

Details

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on Oct. 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619.
The initial exploit originated from an IP address associated with a commercial anonymization network, suggesting a threat actor acquired exploit information prior to the embargo lift.
Following the embargo lift on Oct. 21, 2026, multiple proof-of-concept exploits appeared within hours, and PHP2Shell is now being broadly exploited in the wild.
The shrinking time from patch to working exploit is attributed to AI-assisted analysis, which lowers the cost of turning patch diffs into working exploits.
Security leaders are advised to measure patch timelines in hours rather than days and to start investigations from the earliest known exploitation date (Oct. 17) rather than the disclosure date.
Immediate remediation requires upgrading to fixed PHP versions, as no configuration-only workarounds fully address both CVEs.
AWS analyzes over 200 billion events per minute and uses its MadPot honeypot network to detect and block exploitation attempts in real time.
Indicators of Compromise include six IP addresses observed on Oct. 17 and Oct. 21, 2026, which should be investigated rather than blocked due to shared anonymization infrastructure.

Key point