Amazon Threat Intelligence detected an attempt to exploit the PHP2Shell vulnerability as early as October 17, 2026, in its MadPot telemetry, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit originated from an IP address linked to a commercial anonymization network, raising suspicions of a threat actor's involvement. The vulnerability was under embargo until October 21, 2026, at 1400 UTC, but exploitation attempts began as early as 0200 UTC on the same day, suggesting multiple actors were involved.
Technical analysis is ongoing, but it remains unclear whether any of these attempts would have succeeded in real-world systems. The embargo was lifted at 1400 UTC on October 21, 2026, and within hours, proof-of-concept exploits appeared, leading to broad exploitation in the wild. The incident highlights two key lessons: defenders should not assume the public disclosure date is the earliest date of exploitation, and the time from patch to working exploit is shrinking due to AI-assisted analysis.
For security leaders, this changes several working assumptions. Critical vulnerabilities in internet-facing systems now require patch and mitigation timelines measured in hours, not days. Investigations should start from the earliest known exploitation date, and detections should not rely solely on specific CVE signatures. AWS deploys multiple layers of protection, including its MadPot honeypot network, to identify and block known exploitation attempts in real time.
AWS recommends upgrading immediately to the fixed PHP versions, as there are no configuration-only workarounds that fully address both issues. Organizations should also consider blocking multi-part file uploads in PHP deployments that cannot be patched immediately, review web server logs for suspicious activity, and check for unexpected process execution or file modification on web application servers.