AWS Honeypot Data Shows PHP Flaw Was Hit by Attackers Before Public Patch
Amazon's MadPot honeypot network recorded an exploitation attempt against what is now tracked as CVE-2026-109618 and CVE-2026-109619 — nicknamed PHP2Shell — on October 17, 2026, four days before the vendor publicly disclosed the flaw. The request came from a commercial anonymization network, suggesting a threat actor had working exploit code ahead of the official embargo lift. When the embargo ended on October 21 at 1400 UTC, AWS says proof-of-concept code and real attack traffic hit its sensors within hours, from several distinct sets of infrastructure. AWS argues this points to a structural shift: AI-assisted analysis is making it faster to turn a patch or advisory into a working exploit, shrinking the old assumption that most attacks follow a public PoC.