AWS Identifies PHP2Shell Exploitation Attempts Four Days Before Public Disclosure

Summary

AWS says MadPot telemetry recorded PHP2Shell exploitation attempts on Oct. 17, 2026—four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. It cannot confirm the attempts would succeed against real systems.

Key points

Amazon Threat Intelligence says MadPot recorded a PHP2Shell exploitation attempt on Oct. 17, 2026, while the vulnerabilities were under embargo and four days before public disclosure.
AWS observed multiple proof-of-concept exploits and further attempts against MadPot sensors on Oct. 21, including activity before the embargo lifted at 14:00 UTC.
AWS says varied payloads and anonymization infrastructure suggest multiple actors, but technical analysis is ongoing and success against real-world systems is unclear.
AWS recommends upgrading immediately to fixed PHP versions for CVE-2026-109618 and CVE-2026-109619; it says no configuration-only workaround fully addresses both issues.
For systems that cannot be patched immediately, AWS suggests considering blocking multipart file uploads after assessing application impact, and reviewing logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS.
AWS says listed IP addresses include shared anonymization infrastructure and advises investigating observed activity rather than blocking those addresses outright.

Article Details

Vulnerability Types: Remote code execution
Exploitation Status: active
Exploit Availability: public_poc
Patch Status: available
Workarounds: For deployments that cannot be patched immediately, consider blocking multi-part file uploads after assessing the effect on the application; this is not a complete remediation.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]114[.]163[.]188`	Source IP listed among those associated with PHP2Shell exploitation attempts; the article notes that listed addresses include shared anonymization infrastructure and are not exclusive to this activity.
IPV4	`103[.]216[.]220[.]92`	Source IP listed among those associated with PHP2Shell exploitation attempts; the article notes that listed addresses include shared anonymization infrastructure and are not exclusive to this activity.
IPV4	`134[.]209[.]159[.]64`	Source IP listed among those associated with PHP2Shell exploitation attempts; the article notes that listed addresses include shared anonymization infrastructure and are not exclusive to this activity.
IPV4	`31[.]223[.]184[.]166`	Source IP listed among those associated with PHP2Shell exploitation attempts; the article notes that listed addresses include shared anonymization infrastructure and are not exclusive to this activity.
IPV4	`37[.]19[.]200[.]5`	Source IP listed among those associated with PHP2Shell exploitation attempts; the article notes that listed addresses include shared anonymization infrastructure and are not exclusive to this activity.
IPV4	`95[.]217[.]98[.]37`	Source IP listed among those associated with PHP2Shell exploitation attempts; the article notes that listed addresses include shared anonymization infrastructure and are not exclusive to this activity.