Amazon Threat Intelligence says its MadPot honeypot network recorded a PHP2Shell exploitation attempt on October 17, 2026 — four days before the PHP Foundation released patches for CVE-2026-109618 and CVE-2026-109619 on October 21.

The attempt originated from an IP address tied to a commercial anonymization network.

AWS CISO CJ Moses said the targeting of a honeypot from an anonymized IP 'suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.'

Infosecurity Magazine reports the bugs were found in August by researchers at Calif and Google Cloud's Wiz, collaborating with OpenAI's Patch the Planet project.

Multiple PoC exploits surfaced around 02:00 UTC on October 21 — roughly 12 hours before the scheduled disclosure — and AWS says the varied payloads and infrastructure suggest multiple actors were involved. The PHP team said none of the pre-release PoCs were functional.

Cloudflare CEO Matthew Prince said his network logged thousands of exploitation attempts in the 10 hours before the announcement, jumping to tens of thousands within 45 minutes of it, hundreds of thousands within two hours, and millions by the time he posted on X. WatchTowr also saw mass exploitation immediately after the patches landed, though its head of threat intelligence Jake Knott noted the circulating PoCs 'either don't work at all, test for timing-based differences, or crash the target.'

JFrog has observed fake PoCs and prank malware on GitHub.

The surprising development is not the vulnerability itself — it is that exploitation began while the flaws were still under embargo, before any fix was publicly available. Amazon warns defenders 'should not assume the public disclosure date is the earliest date of exploitation.'

None of the observed attempts has been tied to a confirmed compromise: Defiant reported Wordfence blocked more than 74,000 attempts across over 5 million WordPress sites with zero confirmed breaches, and Dataminr described activity as scanning, fingerprinting, and non-working exploits — though it cautioned working attacks are 'only a matter of time.'

The exposure is enormous. According to VulnCheck, VirusTotal, and Censys figures cited by SecurityWeek, more than 1 million PHP servers were running unpatched software as of October 21, and at least 1 million run end-of-life versions with no fix available — only PHP 8.2 and later receive patches.

Forescout's Sai Molige and Expel's Marcus Hutchins both compared the event to Log4Shell, with Hutchins calling it '50% the way towards Log4J.'

Governments moved pre-emptively: Japan's Nomura, Mitsubishi UFJ, East Japan Railway, and the National Tax Agency suspended services, Finland's Valtori restored government sites after overnight patching, and South Korea raised its alert level.

AWS says investigations should start from October 17 at the latest, and recommends reviewing logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS, unexpected PHP-launched processes, and unexplained file changes.