Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services
- Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct.
- 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.
- The exploit attempt originated from an IP address associated with a commercial anonymization network.
Unverified
- Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct.
- 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.
- The exploit attempt originated from an IP address associated with a commercial anonymization network.
Sources: Amazon