Amazon says PHP2Shell exploit attempts began four days before public disclosure
What happened
An October 22 report says Amazon Threat Intelligence found exploit attempts against the PHP2Shell vulnerability in its MadPot honeypot telemetry dating to October 17, 2026, four days before public disclosure. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and the attempts came from commercial anonymization network IPs. What is disclosed so far is exploit attempts; the report does not say whether any intrusion succeeded or caused damage.
Written by AI from the coverage · updated 1 hour ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageAmazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
Amazon Threat Intelligence 在 MadPot 蜜罐遥测中发现，PHP2Shell 漏洞（CVE-2026-109618 与 CVE-2026-109619）的利用尝试最早可追溯至 2026 年 10 月 17 日，比公开披露早四天，来源为商业匿名化网络 IP。
Heat over time
Not enough continuous observations to draw a trend yet.