Hackers attempted to exploit a critical PHP vulnerability four days before its public disclosure.

Beating AI Express News: Amazon Threat Intelligence reported that its honeypot system MadPot detected exploitation attempts targeting the PHP2Shell vulnerability on October 17, roughly four days before the vulnerability details were publicly disclosed. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution and affect PHP versions 7.x and 8.x. The exploitation attempts originated from IP addresses linked to commercial anonymous networks. Amazon stated it remains unclear how attackers obtained exploitation details during the embargo period, and has not confirmed that real-world systems have been compromised. After patches and public information were released, multiple proof-of-concepts emerged within hours, with several attackers launching probes using different anonymous infrastructures. PHP2Shell is now widely exploited in the wild, Amazon added. Its Chief Information Security Officer CJ Moses noted that AI-assisted analysis is reducing the cost of generating usable exploits from patch differences or announcements, shortening the time window from disclosure to functional exploits.