OTX Threat: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot

Amazon Threat Intelligence discovered PHP2Shell exploitation attempts in MadPot honeypot telemetry on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial exploit originated from a commercial anonymization network, suggesting threat actor involvement during the embargo period. Multiple proof-of-concept exploits emerged on the disclosure date, CVEs: CVE-2026-109618, CVE-2026-109619