PHP2Shell Was Being Exploited Before Anyone Knew It Existed: Lessons from Amazon MadPot
On October 17, 2026, Amazon Threat Intelligence detected active exploitation of PHP2Shell (CVE-2026-109618 and CVE-2026-109619) through its MadPot honeypot network — four days before public disclosure. The exploit originated from anonymized infrastructure, suggesting a threat actor obtained vulnerability details prior to the embargo lift on October 21, 2026. Within hours of the embargo expiring, multiple actors leveraging varied payloads and anonymization infrastructure began broad exploitation, indicating coordinated or parallel independent discovery. AWS's analysis of over 200 billion events per minute enabled rapid detection, but real-world systems without equivalent telemetry or accelerated patching remained exposed. This incident underscores a structural shift in the vulnerability exploitation lifecycle: AI-assisted patch diffing and advisory analysis now compress the time from disclosure to weaponization from days to hours. Security teams can no longer treat public disclosure dates as the start of their exposure window, and traditional 7-to-30-day patch SLAs are operationally obsolete for critical internet-facing systems.
Kill Chain
