IMPLICATOR
Amazon’s MadPot honeypot network recorded a PHP2Shell exploitation attempt on Oct. 17, four days before PHP disclosed and patched the flaws.
The attempt came from an IP address associated with a commercial anonymization network; Amazon says targeting a honeypot from an anonymized address suggests a threat actor.
Amazon says defenders should not assume exploitation began at public disclosure and should investigate from at least Oct. 17.
PHP2Shell comprises two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that can let an unauthenticated attacker run code on a server.
What Changed
- Amazon's MadPot honeypot network recorded a PHP2Shell exploitation attempt on Oct. 17, four days before PHP disclosed and patched CVE-2026-109618 and CVE-2026-109619 on Oct. 21.
- The Oct. 17 attempt predates every leak event in the PHP Foundation's timeline, the first of which came around 15:00 UTC on Oct. 20; Amazon says it remains unclear how the actor got exploit information.
- CISA, Huntress, the PHP Foundation and watchTowr reported no confirmed or working exploitation at the time; Amazon's data covers honeypot attempts, and it says success against real systems is unclear.
- Amazon tells defenders to investigate from at least Oct. 17 and to measure patch timelines for internet-facing systems in hours.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
What Amazon’s sensors recorded
The attempt appeared in MadPot telemetry dated Oct. 17, from one IP address Amazon lists among its indicators for that date. Amazon did not name the anonymization network.
Amazon identified proofs of concept around 02:00 UTC on Oct. 21. Further attempts hit MadPot through 08:00 UTC, with varied payloads and anonymization infrastructure that Amazon said suggest multiple actors. After the embargo lifted at 14:00 UTC, additional proofs of concept appeared within hours and were used against Amazon’s sensors almost immediately.
Technical analysis of these honeypot attempts continues, and Amazon says whether any would have succeeded against real systems is unclear. Its listed IP addresses include shared anonymization infrastructure; Amazon says organizations should investigate sightings of those addresses rather than block them.
“PHP2Shell is now being broadly exploited in the wild,” Amazon said.
FREE WEEKDAY MORNING BRIEFING
Track the PHP2Shell fallout as it unfolds.
The Implicator Morning Briefing filters the AI news cycle to the stories worth your attention and explains their consequences. From San Francisco, every weekday at 4:45 a.m. Pacific, 7:45 a.m. Eastern.
About five minutes. No hype. No spam.
What each account measures
OpenAI wrote in its disclosure post that “To our knowledge, frontier AI found these vulnerabilities before attackers did”.
CISA said it had not observed exploitation as of publication on Oct. 21. Jon Semon, principal security operations analyst at Huntress, said the company had not “observed, or independently confirmed, successful in-the-wild exploitation” on live customer systems.
The PHP Foundation found no functional exploits among circulating proofs of concept at release.
“Whilst nobody has been successful to date,” Jake Knott, head of threat intelligence at watchTowr, said, “we don’t expect that will last long.”
Amazon reports honeypot attempts; CISA, Huntress, the PHP Foundation and watchTowr address observed, confirmed, successful or functional exploitation. Attempts and confirmed or working exploitation measure different things.
Cloudflare observed attack traffic against customers after the leak, including payload changes intended to bypass protections. Its firewall rules were enabled by default from 03:02 UTC on Oct. 21.
Earlier than the leak
The vulnerability identifiers circulated around 15:00 UTC on Oct. 20 without technical details. Calif mistakenly published a demonstration video around 20:00 UTC. Mitigation advice shared with critical infrastructure providers around 23:00 UTC “may have leaked as well,” the PHP Foundation said.
Know someone who'd find this useful? ✉️ Email it to a friend in one click, or they can subscribe free here.
Each of those events came after the Oct. 17 attempt.
Amazon said it “remains unclear how the actor acquired exploit information prior to disclosure.”
What defenders are told to do
“A 7-day or 30-day SLA assumes a delay that no longer exists,” Amazon said. Amazon advises patch timelines measured in hours for internet-facing systems.
Upgrading is the only complete fix; no configuration-only workaround addresses both flaws. Administrators should review POST requests containing PHP_SESSION_UPLOAD_PROGRESS and consider blocking multipart uploads while patching waits, after checking application impact.
The fixed Oct. 21 releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
About 758,000 version-disclosing servers run PHP 5.4 through 8.1, branches no longer receiving security updates, against 272,000 on supported branches, in VirusTotal figures reported Oct. 21. As of Oct. 21, a recent Censys scan had counted about 2.58 million internet-facing hosts running PHP.
“One thing AI systems are really good at is turning a patch into an exploit, since a patch is a recipe for ‘what has changed,’” security researcher Nicholas Weaver said.
Frequently Asked Questions
What did Amazon find?
Amazon's MadPot honeypot network recorded a PHP2Shell exploitation attempt dated Oct. 17, 2026, four days before PHP disclosed and patched the two flaws on Oct. 21. The attempt came from an IP address associated with a commercial anonymization network.
Did the attempt succeed?
Amazon does not know. The attempts hit honeypots, technical analysis continues, and Amazon says it is unclear whether any would have succeeded against real systems. It also says it remains unclear how the actor acquired exploit information before disclosure.
Why does Amazon's account differ from CISA's and Huntress's?
They measure different things. Amazon reports attempts against its honeypots. CISA said it had not observed exploitation as of Oct. 21, and Huntress had not observed or confirmed successful exploitation on live customer systems.
Did the attempt come after the leak?
No. The vulnerability identifiers began circulating around 15:00 UTC on Oct. 20, and Calif's video and possibly leaked mitigation advice followed that evening. Each of those events came after the Oct. 17 attempt.
What should administrators do?
Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the only complete fix. Amazon advises investigating from at least Oct. 17, reviewing POST requests containing PHP_SESSION_UPLOAD_PROGRESS, and considering blocking multipart uploads where patching must wait.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Free AI briefing · Weekdays
The AI stories that matter, sourced and explained.
Join the Morning Briefing. It goes out every weekday at 4:45 a.m. Pacific, with later sends for the East Coast, Berlin and Tokyo.
Free when you sign up: The Paperclip Compendium, our tested guide to running AI agents.
Free. Unsubscribe in one click.
Marcus Schuler
Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai
