Amazon's MadPot honeypot network detected exploitation attempts against two PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — on October 17, 2026, a full four days before the coordinated disclosure date of October 21. The exploit traffic originated from a commercial anonymization network, suggesting a threat actor who had independently discovered or obtained the vulnerability details while the information was still under embargo. How that actor acquired the exploit information remains unknown. The timeline accelerated sharply on disclosure day. Proof-of-concept exploits appeared at 0200 UTC on October 21, twelve hours before the 1400 UTC embargo lift. Between 0200 and 0800 UTC, Amazon observed multiple distinct exploitation attempts from varied anonymized infrastructure, with different payloads and anonymization choices — indicating several independent actors, not one campaign. Once the embargo formally lifted and the patch dropped, additional PoC exploits proliferated within hours and were immediately weaponized against Amazon's sensors. PHP2Shell is now broadly exploited in the wild. The structural lesson is not that embargoes fail — they remain the best coordinated disclosure model available. The lesson is that the assumption baked into every enterprise patch SLA — that exploitation begins after public disclosure — is now empirically false. Amazon's telemetry shows compromise may predate the advisory itself. Any forensic investigation scoped from the disclosure date forward is, by definition, incomplete. Amazon attributes the collapsing exploit-development timeline to AI-assisted vulnerability analysis. Turning a patch diff or advisory into a working exploit used to require a small number of skilled researchers. That bottleneck is dissolving. More actors can now independently produce working exploits within hours or minutes of technical details becoming available. The dependency on public PoC releases as a trigger for mass exploitation is weakening. The operational implications are concrete. For critical internet-facing vulnerabilities, patch timelines must be measured in hours, not the 7-day or 30-day SLAs most organizations still enforce. Investigations should start from the earliest known exploitation date — for PHP2Shell, that is October 17, not October 21. Detection strategies that depend on CVE-specific signatures will miss the first wave of exploitation, because exploitation arrives before signatures exist. AWS claims its internal threat intelligence system automatically detected and restricted scanning attempts, processing over 200 billion events per minute with MadPot integration. The company recommends immediate upgrade to fixed PHP versions as the only complete remediation, with interim mitigations including blocking multi-part file uploads, monitoring for PHPSESSIONUPLOADPROGRESS strings, and deploying AWS WAF rules. Six IP addresses were published as indicators of compromise, with the caveat that they represent shared anonymization infrastructure. This is a vendor intelligence disclosure that simultaneously serves as a product advertisement — Amazon is both the narrator and the seller of the solution. That framing matters. The underlying data, however, describes a real and accelerating structural shift in vulnerability economics that affects every organization running internet-facing PHP, regardless of cloud provider.
