Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Summary
AWS Security Blog reports that Amazon Threat Intelligence detected a PHP2Shell exploitation attempt in MadPot before public disclosure of CVE-2026-109618/109619. The post discusses embargo timing, multiple actors, and the shrinking patch-to-exploit window, plus practical defensive guidance and IOC indicators. It emphasizes rapid patching, broader detection strategies, and how AWS protections help mitigate exposures.