Amazon Finds PHP2Shell Exploit Early

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on Oct. 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The activity originated from an IP address associated with a commercial anonymization network targeting a honeypot.