Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure
- PHP2Shell: 3 events in the last 90 days
- Previous: earlier the same day · What the PHP2Shell rumors got wrong, from inside the PHP security team
What happened
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address […]
Summary assembled by rule from the sources below