Amazon’s Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.
“The exploit attempt originated from an IP address associated with a commercial anonymization network,” CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.”
The attempt, Amazon said, was recorded from “103.216.220[.]92,” an IP address geolocated to Australia.
The activity relates to a set of two vulnerabilities impacting PHP core, both rated 9.2 on the CVSS scoring system. Tracked as CVE-2026-109618 and CVE-2026-109619…
https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
