Amazon Honeypot Detected PHP Exploit Attempts Before Public Disclosure

Amazon’s MadPot honeypot logged attempts to exploit two critical PHP vulnerabilities on Oct. 17, roughly four days before PHP2Shell details became public, exposing a pre-disclosure risk for systems running affected PHP versions.

The flaws, CVE-2026-109618 and CVE-2026-109619, affect PHP 7.x and 8.x and can allow remote code execution without authentication. An attacker would not need a user account to try to run code on an affected system. The observed traffic came from IP addresses linked to commercial anonymity networks.

Proof-of-concept code surfaced within hours after patches and public details appeared. Attackers used multiple anonymity services to probe for vulnerable systems, and PHP2Shell was under widespread exploitation.

AI-assisted analysis is lowering the cost of turning patch differences and security notices into working exploits. The time between disclosure and a usable exploit is shrinking.