Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address […]
Summary
Amazon Threat Intelligence detected an attempt to exploit the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 on October 17, 2026, prior to their public announcement. The exploit originated from an IP address linked to a commercial anonymization network, targeting a honeypot. This incident highlights the proactive measures taken by Amazon in monitoring potential threats even before vulnerabilities are publicly disclosed.
Comments (81 of ) ⌛