Amazon says a PHP2Shell attempt hit a honeypot on Oct. 17

Amazon Threat Intelligence said on Oct. 21 that MadPot recorded a PHP2Shell exploitation attempt on Oct. 17, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The attempt came from an address tied to a commercial anonymization network, and Amazon said it does not know how the actor obtained exploit details during the embargo. Amazon also said later attempts on Oct. 21 used varying payloads and that the flaws are now broadly exploited. It did not say a customer system was compromised.