Amazon Honeypot Detected PHP Exploit Attempts Before Public Disclosure

Amazon’s MadPot honeypot logged attempts to exploit two critical PHP vulnerabilities on Oct. 17, roughly four days before PHP2Shell details became public, exposing a pre-disclosure risk for systems running affected PHP versions. The flaws, CVE-2026-109618 and CVE-2026-109619, affect PHP 7.x and 8.x and can allow remote code execution without authentication. An attacker would not need a user account to try to run code on an affected system. The observed traffic came from IP addresses linked to commercial anonymity networks. Proof-of-concept code surfaced within hours after patches and public details appeared.

Source: TokenPost