Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot

Oh boy.

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619.