AWS Honeypot Data Shows PHP Flaw Was Hit by Attackers Before Public Patch
In short: Amazon's MadPot honeypot network recorded an exploitation attempt against what is now tracked as CVE-2026-109618 and CVE-2026-109619 — nicknamed PHP2Shell — on October 17, 2026, four days before the vendor publicly disclosed the flaw. The request came from a commercial anonymization network, suggesting a threat actor had working exploit code ahead of the official embargo lift. When the embargo ended on October 21 at 1400 UTC, AWS says proof-of-concept code and real attack traffic hit its sensors within hours, from several distinct sets of infrastructure. AWS argues this points to a structural shift: AI-assisted analysis is making it faster to turn a patch or advisory into a working exploit, shrinking the old assumption that most attacks follow a public PoC.
This summary was generated automatically by AI from AWS Security's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1Pre-disclosure exploitation attempt logged Oct 17, 2026 — four days ahead of the embargo lift — from an IP tied to commercial anonymization infrastructure
- 2Embargo on CVE-2026-109618 and CVE-2026-109619 lifted Oct 21, 2026 at 1400 UTC
- 3Multiple proof-of-concept exploits surfaced as early as 0200 UTC that day, before the official release, with more attempts logged through 0800 UTC from varied infrastructure, pointing to several separate actors
- 4Patching is the only full fix; there is no configuration change that resolves both CVEs on its own
- 5AWS published six indicator IP addresses (observed Oct 17 and Oct 21) tied to shared anonymization infrastructure, cautioning these should be investigated rather than blanket-blocked
- 6Interim mitigation: block multipart file uploads where patching isn't immediately possible, watch for PHP_SESSION_UPLOAD_PROGRESS in POST requests, and audit web server logs and process activity for signs of compromise
Why it matters
This case shows that disclosure dates no longer mark the start of real-world risk — some attackers may already have working exploits before an advisory goes public, and once it does, mass exploitation can follow within hours rather than the days or weeks security teams used to plan around. For any team running internet-facing PHP applications, patch SLAs measured in days are now too slow, and detection strategies need to catch anomalous behavior rather than wait for a CVE-specific signature.
What it means for AI agents and contact centers
If any customer-facing or internal web application in your stack runs PHP (admin panels, CRM web interfaces, internal tools), check whether it's affected by CVE-2026-109618/CVE-2026-109619 and patch immediately rather than waiting for a scheduled maintenance window; also review logs for the listed IOC IPs and the PHP_SESSION_UPLOAD_PROGRESS pattern even if you believe you patched promptly, since exploitation began before public disclosure.
Sources
- AWS SecurityOfficialPrimary sourceOriginal article →„Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot“22 Oct 2026, 01:36
- Published by source
- 22 Oct 2026, 01:36
- Found by our system
- 22 Oct 2026, 01:56
- Summary generated
- 22 Oct 2026, 01:58
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy