Amazon Threat Intelligence Discovers PHP2Shell Exploitation Four Days Before Public Disclosure
Amazon Threat Intelligence identified an exploitation attempt of PHP2Shell on October 17, 2026, in MadPot telemetry, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor. The source of the exploit information before the official disclosure remains unclear.
The embargo window for the PHP vulnerability was scheduled to be lifted on October 21, 2026, at 14:00 UTC. On the day of the release, Amazon Threat Intelligence identified multiple proof-of-concept exploits, with the earliest detected around 02:00 UTC. From 02:00 UTC to 08:00 UTC, the threat intelligence system identified additional exploitation attempts targeting MadPot from anonymized infrastructure. The payloads and choice of anonymization varied, indicating multiple actors were involved. Technical analysis is ongoing, and it is unclear if any of these attempts would have succeeded in real-world systems.
Upon lifting the embargo and releasing the patch, proof-of-concept exploits appeared within hours and were used against Amazon’s sensors almost immediately. PHP2Shell is now being broadly exploited in the wild.
Several key lessons from this event are applicable beyond this specific vulnerability:
1. Security Assumptions: AWS deploys multiple layers of protection to help safeguard customers. The internal threat intelligence system automatically detected and restricted malicious scanning attempts. AWS analyzes over 200 billion events per minute and integrates threat intelligence from the MadPot honeypot network to identify and block known exploitation attempts in real time. The honeypot system provided early detection, enabling rapid response and threat analysis.
2. IP Addresses: The identified IP addresses include shared anonymization infrastructure and are not exclusive to this threat activity. Organizations should investigate any observations involving these addresses rather than blocking them outright.
Security Leaders and AWS Recommendations:
– CJ Moses, Amazon’s CISO, oversees security engineering and operations across the company, aiming to make security benefits the path of least resistance.
– AWS Web Application Firewall: Use AWS Web Application Firewall (WAF) to help reduce exposure while patching (https://aws.amazon.com/blogs/security).
CJ Moses, CISO of Amazon Integrated Security, brings extensive experience from the Federal Bureau of Investigation’s Cyber Division and the Air Force Office of Special Investigations. He holds degrees in Computer Science and Criminal Justice and is an active race car driver.