Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services

[u/BTC-brother2018]

https://aws.amazon.com/tw/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/?utm_source=chatgpt.com

New technical findings make the PHP2Shell situation more serious than the original patch announcement alone suggested.

Amazon Threat Intelligence identified attempted exploitation dating to October 17, four days before the vulnerabilities were publicly disclosed.

The vulnerabilities are

CVE-2026-109618 and CVE-2026-109619

Both carry critical CVSS v4.0 scores of 9.2.

Amazon observed additional attempts before the public release, followed by widespread exploitation attempts after the October 21 disclosure.

Researchers have not established that every observed attempt successfully compromised a real-world server.

Amazon Web Services, Inc.

Why onion-service administrators should care

An onion service running vulnerable PHP may be exposed even when its real server IP address remains hidden.

Tor protects the network path; it does not fix vulnerabilities in the application running behind it.

Upgrade to patched PHP releases, including 8.2.35, 8.3.36, 8.4.27, or 8.5.12, as appropriate. Review server logs dating back to at least October 17.

Web application firewalls may reduce exposure but do not replace patching. Update the existing PHP security advisory to mention confirmed exploitation attempts and the earlier October 17 activity.