Amazon Threat Intelligence Spots PHP2Shell Attacks Before They Go Public

Amazon Threat Intelligence caught PHP2Shell exploitation attempts in MadPot honeypots four days before CVE-2026-109618 and CVE-2026-109619 went public, with attacks originating from anonymized IPs. As a cloud engineer, you should monitor your PHP applications closely and patch these vulnerabilities immediately once disclosed—threat actors are already hunting for them.