Amazon Detected PHP2Shell Exploits 4 Days Before Public Disclosure

Amazon's security research team, using the MadPot honeypot network, detected exploitation attempts targeting the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) as early as October 17, 2026 — four days before the coordinated public disclosure on October 21, 2026 at 14:00 UTC. The earliest attempts originated from an IP address associated with a third-party anonymization network.

On the disclosure day itself, multiple proof-of-concept (PoC) codes appeared, the first around 02:00 UTC. Between 02:00 and 08:00 UTC, MadPot observed a surge of exploitation attempts from diverse anonymous infrastructures, each carrying different code or data payloads, indicating multiple independent threat actors. Whether these attempts succeed against real systems remains under analysis.

Within hours of patch release, additional PoC codes emerged and were almost immediately observed in active exploitation by MadPot sensors. PHP2Shell now shows widespread exploitation activity.

Two Key Lessons Beyond This Single Vulnerability

1. Defenders must gain time before attackers independently discover the same vulnerability. Coordinated disclosure remains correct, but organizations cannot assume the public disclosure date equals the earliest exploitation date. For PHP2Shell, the potential exposure window likely began well before the security advisory was published.

2. The gap between patch release and usable exploit code is shrinking due to AI. Historically, most exploitation occurred after public PoC availability — only a few skilled attackers wrote exploits, others reused them. That dependency is eroding: AI-assisted analysis dramatically lowers the barrier to turning patch diffs or advisories into working exploits. Once technical details are public, more actors can act within hours or even minutes.

Outdated Assumptions Security Leaders Must Update

Patch and mitigation windows for internet-facing critical vulnerabilities must be measured in hours. Traditional 7-day or 30-day SLAs assumed buffer time that no longer exists.

Investigations should start from the earliest known exploitation time, not the disclosure date. For PHP2Shell, forensic scoping must reach back to at least October 17.

Invest in detection capabilities that do not rely on specific CVE signatures. First exploitation often occurs before signatures are available.

Amazon's Multi-Layered Protection

AWS has built a multi-layered defense system. Internal security risk systems automatically detected and blocked anomalous scanning activity targeting this vulnerability. Leveraging analysis of over 200 billion events per minute combined with MadPot threat intelligence, AWS identifies and blocks known exploitation attempts in real time. The honeypot system enabled early awareness, rapid response, and timely risk analysis.

Recommended Immediate Actions

Upgrade to patched PHP versions immediately. Upgrading is the only complete fix for CVE-2026-109618 and CVE-2026-109619; no configuration-only workaround fully bypasses both vulnerabilities.

If patching is temporarily impossible, consider disabling multipart file uploads. Assess application impact before deploying this mitigation.

Monitor for suspicious form upload requests. Focus on POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string.

Review web server logs for anomalous activity.

Inspect web application servers for unexpected process execution or file modifications.

From Threat Discovery to Remediation: Vulnerability Management Must Match Attack Tempo

PHP2Shell demonstrates that the window from disclosure to exploitation attempts can be mere hours. To keep pace, vulnerability management must shift from periodic scanning to continuous operation.

Amazon Continuum, an AI-native security capability from AWS, continuously identifies potential vulnerabilities in code and assets, prioritizes them by exploitability and business impact, validates whether vulnerabilities are actually exploitable, and supports automated remediation workflows — helping teams shrink the discovery-to-fix cycle. (Amazon Continuum is currently available in AWS overseas regions.)