> ## Content Index > Fetch the complete content index at: https://www.implicator.ai/llms.txt > Use this file to discover other available public pages before exploring further. # Amazon Logged a PHP2Shell Exploit Attempt Four Days Before Disclosure - URL: https://www.implicator.ai/amazon-logged-a-php2shell-exploit-attempt-four-days-before-disclosure/ - Published: 2026-10-22T13:28:45.000Z - Updated: 2026-10-22T13:28:45.000Z - Description: Amazon's honeypot network logged an attempt to exploit the critical PHP2Shell flaws on Oct. 17, four days before PHP shipped patches and three days before the first known leak. CISA, Huntress and the PHP Foundation had seen no working exploitation. Amazon says investigations should start Oct. 17. - Author: Marcus Schuler - Tags: AI News Amazon’s MadPot honeypot network [recorded a PHP2Shell exploitation attempt](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/?ref=implicator.ai) on Oct. 17, four days before PHP [disclosed and patched the flaws](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/?ref=implicator.ai). The attempt came from an IP address associated with a commercial anonymization network; Amazon says targeting a honeypot from an anonymized address suggests a threat actor. Amazon says defenders should not assume exploitation began at public disclosure and should investigate from at least Oct. 17. PHP2Shell comprises two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that can let an unauthenticated attacker run code on a server. What Changed - Amazon's MadPot honeypot network recorded a PHP2Shell exploitation attempt on Oct. 17, four days before PHP disclosed and patched CVE-2026-109618 and CVE-2026-109619 on Oct. 21. - The Oct. 17 attempt predates every leak event in the PHP Foundation's timeline, the first of which came around 15:00 UTC on Oct. 20; Amazon says it remains unclear how the actor got exploit information. - CISA, Huntress, the PHP Foundation and watchTowr reported no confirmed or working exploitation at the time; Amazon's data covers honeypot attempts, and it says success against real systems is unclear. - Amazon tells defenders to investigate from at least Oct. 17 and to measure patch timelines for internet-facing systems in hours. AI-generated summary, reviewed by an editor. [More on our AI guidelines](https://www.implicator.ai/about/). ## What Amazon’s sensors recorded The attempt appeared in MadPot telemetry dated Oct. 17, from one IP address Amazon lists among its indicators for that date. Amazon did not name the anonymization network. Amazon identified proofs of concept around 02:00 UTC on Oct. 21\. Further attempts hit MadPot through 08:00 UTC, with varied payloads and anonymization infrastructure that Amazon said suggest multiple actors. After the embargo lifted at 14:00 UTC, additional proofs of concept appeared within hours and were used against Amazon’s sensors almost immediately. Technical analysis of these honeypot attempts continues, and Amazon says whether any would have succeeded against real systems is unclear. Its listed IP addresses include shared anonymization infrastructure; Amazon says organizations should investigate sightings of those addresses rather than block them. “PHP2Shell is now being broadly exploited in the wild,” Amazon said. FREE WEEKDAY MORNING BRIEFING Track the PHP2Shell fallout as it unfolds. The Implicator Morning Briefing filters the AI news cycle to the stories worth your attention and explains their consequences. From San Francisco, every weekday at 4:45 a.m. Pacific, 7:45 a.m. Eastern. Email address Send me tomorrow’s briefing Check your inbox for the confirmation link. About five minutes. No hype. No spam. ## What each account measures OpenAI wrote in its disclosure post that [“To our knowledge, frontier AI found these vulnerabilities before attackers did”](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/?ref=implicator.ai). CISA said it had not observed exploitation as of publication on Oct. 21\. Jon Semon, principal security operations analyst at Huntress, said the company had not [“observed, or independently confirmed, successful in-the-wild exploitation”](https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/?ref=implicator.ai) on live customer systems. The PHP Foundation found no functional exploits among circulating proofs of concept at release. “Whilst nobody has been successful to date,” Jake Knott, head of threat intelligence at watchTowr, said, “we don’t expect that will last long.” Amazon reports honeypot attempts; CISA, Huntress, the PHP Foundation and watchTowr address observed, confirmed, successful or functional exploitation. Attempts and confirmed or working exploitation measure different things. Cloudflare [observed attack traffic](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/?ref=implicator.ai) against customers after the leak, including payload changes intended to bypass protections. Its firewall rules were enabled by default from 03:02 UTC on Oct. 21. ## Earlier than the leak The vulnerability identifiers circulated around 15:00 UTC on Oct. 20 without technical details. Calif mistakenly published a demonstration video around 20:00 UTC. Mitigation advice shared with critical infrastructure providers around 23:00 UTC “may have leaked as well,” the PHP Foundation said. Know someone who'd find this useful? [✉️ Email it to a friend in one click](mailto:?subject=A%20newsletter%20I%20think%20you%27d%20like&body=This%20is%20one%20of%20maybe%20three%20newsletters%20I%20actually%20read.%20The%20rest%20just%20pile%20up%2C%20unread%2C%20judging%20me.%0A%0AAnd%20yes%2C%20this%20email%20mostly%20wrote%20itself%2C%20which%20is%20a%20little%20on%20the%20nose%20for%20an%20AI%20newsletter.%20Doesn%27t%20make%20it%20wrong.%20implicator.ai%20is%20good.%0A%0ASubscribe%20free%3A%20https%3A%2F%2Fwww.implicator.ai%2Fsubscribe%2F%3Futm%5Fsource%3Dnewsletter%26utm%5Fmedium%3Dforward%26utm%5Fcampaign%3Demail%5Fforward), or they can [subscribe free here](https://www.implicator.ai/subscribe/?utm%5Fsource=newsletter&utm%5Fmedium=forward&utm%5Fcampaign=forward%5Fto%5Fcolleague). Each of those events came after the Oct. 17 attempt. Amazon said it “remains unclear how the actor acquired exploit information prior to disclosure.” ## What defenders are told to do “A 7-day or 30-day SLA assumes a delay that no longer exists,” Amazon said. Amazon advises patch timelines measured in hours for internet-facing systems. Upgrading is the only complete fix; no configuration-only workaround addresses both flaws. Administrators should review POST requests containing `PHP_SESSION_UPLOAD_PROGRESS` and consider blocking multipart uploads while patching waits, after checking application impact. The fixed Oct. 21 releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. About 758,000 version-disclosing servers run PHP 5.4 through 8.1, branches no longer receiving security updates, against 272,000 on supported branches, in VirusTotal figures reported Oct. 21\. As of Oct. 21, a recent Censys scan had counted about 2.58 million internet-facing hosts running PHP. “One thing AI systems are really good at is turning a patch into an exploit, since a patch is a recipe for ‘what has changed,’” security researcher Nicholas Weaver said. Frequently Asked Questions What did Amazon find? Amazon's MadPot honeypot network recorded a PHP2Shell exploitation attempt dated Oct. 17, 2026, four days before PHP disclosed and patched the two flaws on Oct. 21\. The attempt came from an IP address associated with a commercial anonymization network. Did the attempt succeed? Amazon does not know. The attempts hit honeypots, technical analysis continues, and Amazon says it is unclear whether any would have succeeded against real systems. It also says it remains unclear how the actor acquired exploit information before disclosure. Why does Amazon's account differ from CISA's and Huntress's? They measure different things. Amazon reports attempts against its honeypots. CISA said it had not observed exploitation as of Oct. 21, and Huntress had not observed or confirmed successful exploitation on live customer systems. Did the attempt come after the leak? No. The vulnerability identifiers began circulating around 15:00 UTC on Oct. 20, and Calif's video and possibly leaked mitigation advice followed that evening. Each of those events came after the Oct. 17 attempt. What should administrators do? Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the only complete fix. Amazon advises investigating from at least Oct. 17, reviewing POST requests containing PHP\_SESSION\_UPLOAD\_PROGRESS, and considering blocking multipart uploads where patching must wait. AI-generated summary, reviewed by an editor. [More on our AI guidelines](https://www.implicator.ai/about/). [PHP Patches AI-Found Flaws First Spotted in 2024Two critical flaws in PHP, which runs on 69.3% of websites with a known server-side language, got emergency patches on Oct. 21\. An AI-assisted audit turned a weakness the project spotted in 2024 into a working attack. Then the embargo broke.Implicator.ai![](https://www.implicator.ai/content/images/size/w1200/2026/10/20261021-213137-php_patch_offline.webp)](https://www.implicator.ai/php-patches-ai-found-memory-flaws/) [Anthropic Offers Open-Source Projects Free Mythos Bug Scans With No Human ReviewAnthropic launched OSS Scanner on Oct. 8, a free opt-in service that sends model-generated vulnerability reports to eligible open-source projects without human review. Its models flagged 29,439 candidThe Implicator![](https://www.implicator.ai/content/images/2026/10/20261009-071930-oss_scanner_maintainer.webp)](https://www.implicator.ai/anthropic-oss-scanner-free-unreviewed-bug-reports/) [OpenAI Gates Astra Cyber Access After First Critical Risk RatingOpenAI classified its unreleased Astra model as a Critical cybersecurity capability on September 1, 2026, and said it plans to release the model soon while withholding its strongest cyber functions frThe Implicator![](https://www.implicator.ai/content/images/2026/09/20260902-061905-astra_cyber_gate.webp)](https://www.implicator.ai/openai-gates-astra-cyber-access-after-first-critical-risk-rating/)