Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Amazon Threat Intelligence detected exploitation attempts against the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) targeting a MadPot honeypot on October 17, 2026 - four days before public disclosure. The initial activity originated from IP space tied to commercial anonymization services; additional proof-of-concept exploits and attacks were observed beginning October 21 around 02:00-08:00 UTC from multiple anonymized sources, and exploitation increased rapidly after the embargo lifted at 14:00 UTC on October 21. Analysis shows varied payloads and anonymization choices consistent with multiple actors; it remains unclear how any actor obtained exploit details prior to disclosure or whether early attempts would have succeeded. Amazon published six IOC IPs (including 103.216.220.92) but cautioned these are shared anonymization infrastructure and should be investigated rather than reflexively blocked.

The report draws two operational conclusions: coordinated disclosure still helps defenders, but compromises can predate advisories, and the interval from patch release to working exploit is shrinking as techniques and AI-assisted analysis make exploit development faster. Security teams should treat patch/mitigation SLAs in hours for internet-facing systems, begin investigations from the earliest observed exploitation (at least October 17), and deploy detections that do not depend solely on CVE-specific signatures. Immediate actions recommended are updating to fixed PHP versions, considering blocking multipart uploads if unpatchable, searching for POST requests with PHP_SESSION_UPLOAD_PROGRESS, reviewing web logs and server process/file changes, and using WAF mitigations while patching.