Hackers attempted to exploit a critical PHP vulnerability four days before it was publicly disclosed.

Beating AI News Flash: Amazon Threat Intelligence stated that its honeypot system MadPot observed exploitation attempts targeting the PHP2Shell vulnerability on October 17, approximately four days before the relevant details were publicly disclosed. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, which can lead to unauthenticated remote code execution and affect PHP 7.x and 8.x. The attempts originated from IPs associated with commercial anonymization networks. Amazon said it is not yet clear how attackers obtained exploit information during the embargo period, and it has not confirmed that real systems have been compromised.

Amazon said that multiple proofs of concept appeared within hours after the patch and public information were released, and multiple attackers launched probes using different anonymization infrastructure. PHP2Shell is now being widely exploited in the wild. Its Chief Information Security Officer CJ Moses said that AI-assisted analysis is lowering the cost of generating usable exploits from patch diffs or advisories, and the window from disclosure to a working exploit is shrinking.