Amazon’s Threat Intelligence team detected an attempt to exploit the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) four days before their public disclosure, targeting its MadPot honeypot from an anonymized IP address. These flaws affect PHP versions 7.x and 8.x, allowing unauthenticated remote code execution with virtually no detectable traces, prompting worldwide cybersecurity agencies to urge immediate patching as exploitation attempts by multiple threat actors have since increased significantly.
https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html