Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Source AlienVault OTX General
Mentions 2 CVEs
Mentioned vulnerabilities
Description
Amazon Threat Intelligence detected exploitation attempts of the PHP2Shell vulnerability in MadPot honeypot telemetry on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial exploit originated from a commercial anonymization network, indicating threat actor activity during the embargo period. Multiple proof-of-concept exploits appeared on the disclosure date with diverse payloads and infrastructure, suggesting involvement of multiple actors. After the embargo lifted on October 21, 2026, exploitation rapidly became widespread. This incident demonstrates that coordinated vulnerability disclosure does not guarantee zero-day protection and that AI-assisted exploit development has significantly reduced the time from patch release to active exploitation.
Impact
The PHP2Shell vulnerabilities were exploited in the wild before public disclosure, allowing threat actors to attempt remote code execution attacks. The rapid proliferation of exploits after the embargo lift increased the risk of compromise for vulnerable systems. The involvement of multiple actors and varied payloads suggests a broad and diverse threat landscape. Organizations face increased pressure to apply patches within hours due to the shortened window between disclosure and exploitation.
Defensive guidance
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor vendor communications for official patches addressing CVE-2026-109618 and CVE-2026-109619 and apply them promptly. Due to the rapid exploitation timeline, patching should be prioritized and accelerated to reduce exposure. No vendor advisory content is provided here to confirm patch availability or temporary mitigations.
Summary
Amazon Threat Intelligence identified early exploitation attempts of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) prior to their public disclosure. Exploitation was first observed on October 17, 2026, originating from a commercial anonymization network, implying threat actor engagement during the embargo period. On the disclosure date, multiple proof-of-concept exploits with varied payloads and infrastructure were observed, indicating multiple threat actors. Following the embargo lift on October 21, exploitation became widespread within hours. This case highlights the limitations of coordinated disclosure in preventing zero-day exploitation and the accelerated timeline for exploit development enabled by AI-assisted analysis.
MITRE ATT&CK techniques
- T1190Exploit Public-Facing Application · Initial Access (opens in a new tab)
- T1595.002Active Scanning: Vulnerability Scanning · Reconnaissance (opens in a new tab)
- T1583.003Acquire Infrastructure: Virtual Private Server · Resource Development (opens in a new tab)
- T1059.004Command and Scripting Interpreter: Unix Shell · Execution (opens in a new tab)
- T1505.003Server Software Component: Web Shell · Persistence (opens in a new tab)
Indicators of compromise
IP addresses 6
- 144.172.64.99CC=US ASN=AS8100 quadranet enterprises llc
- 144.172.64.128CC=US ASN=AS8100 quadranet enterprises llc
- 144.172.64.60CC=US ASN=AS8100 quadranet enterprises llc
- 187.15.88.186CC=BR ASN=AS7738 telemar norte leste s.a.
- 187.15.90.217CC=BR ASN=AS7738 telemar norte leste s.a.
- 187.15.89.186CC=BR ASN=AS7738 telemar norte leste s.a.
CVEs 2
- CVE-2026-109618
- CVE-2026-109619