aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Amazon Threat Intelligence saw a PHP2Shell exploitation attempt against its MadPot honeypot on Oct. 17, 2026, four days before CVE-2026-109618 and CVE-2026-109619 were disclosed. More attempts followed within hours of the patch, and Amazon advises immediate upgrades and investigating from the earliest exploitation date.
— via AWS Security Blog, CJ Moses
