← All reports

A PHP2Shell exploitation attempt was identified by Amazon Threat Intelligence on October 17, 2026, prior to the public disclosure of CVE-2026-109618 and CVE-2026-109619.

CybersecurityThreat IntelligenceOct 22, 2026score 0.652 posts · 1 replies across 2 instances
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on October 17, 2026, four days before the public disclosure of two related CVEs. The attack originated from an IP linked to a commercial anonymization network, raising questions about how the threat actor obtained exploit information before the vulnerability was disclosed.

Claims

A PHP2Shell exploitation attempt was identified by Amazon Threat Intelligence on October 17, 2026, prior to the public disclosure of CVE-2026-109618 and CVE-2026-109619.
Parent: CybersecurityEntity: PHP2Shell exploitationImpact: negativeDate: Oct 22, 2026Target: The timing and source of the PHP2Shell exploitation attempt
The PHP2Shell exploitation attempt was conducted by a threat actor, as evidenced by the targeting of a honeypot from an anonymized IP.
Parent: CybersecurityEntity: Threat actor activityImpact: negativeDate: Oct 22, 2026Target: The attribution of the PHP2Shell exploitation attempt to a threat actor

Source posts

@[email protected]
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on 2026-10-17 in MadPot telemetry, 4 days before public disclosure of CVE-2026-109618 & CVE-2026-109619. It originated from an IP associated w/a commercial anonymization network. While the vuln was under embargo, the targeting of a honeypot from an anonymized IP suggests the activity was conducted by a threat actor, tho it remains unclear how the actor acquired exploit information prior to disclosure. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
9 boosts · 9 favs · 1 replies · Oct 22, 2026
@[email protected]
Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ https://news.ycombinator.com/item?id=50194070
0 boosts · 0 favs · 0 replies · Oct 22, 2026