There are weaknesses that can be hidden for years and when someone finally finds them, they are still there Not disclosed immediately. Then a disjointed race begins: understanding what they allow, preparing a fix, and coordinating its dissemination before the information reaches anyone who might take advantage of it. It’s a delicate balance and quite common in cyber security. What’s much less common is discovering later that someone was already trying their luck when, in theory, almost no one outside that circle would know enough.
This is exactly what Amazon Threat Intelligence claims to have observed with PHP2Shell. Its MadPot network registered an attempt to exploit these vulnerabilities on October 17, four days before the coordinated public release and release of the patches on the 21st. Amazon believes the characteristics of that activity point to a malicious actor, but there’s one piece that still doesn’t fit: It doesn’t know how it got information about the exploit before the public.
MadPot is not a compromised production server, but a network of honeypots, decoy systems that Amazon exposes to attract malicious activity and observe how those who try to attack them behave. The attempt has also come a IP is associated with a commercial anonymous networkA sign why the company considers that a malicious actor was behind it. This telemetry shows that the attempt existed, but not that an actual website was compromised. For Amazon, the practical consequences lie elsewhere: Companies should review their records at least since October 17, not just since the notice was published.
Someone came first
We have to go back to August to understand how we got here. On the 11th of that month, Calif notified the PHP team of an issue related to a remote code execution path that maintainers had already observed in 2024, and that OpenAI had independently reached the same cause. Wiz began his independent investigation on August 19 and reported his findings to the PHP team on the 24th. Artificial intelligence has played a role in several of these investigations, both in the discovery and development and validation of highly complex exploit routes, but we have no evidence that it explains what happened on October 17. The complete history is also collected by the PHP Foundation.
PHP2Shell groups two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, Both rated 9.2 out of 10. The problem is with core parts of PHP related to memory management and errors, not a specific plugin or application. According to Cloudflare, under certain conditions, a specially crafted HTTP request can cause the server to use internal data in an insecure state and execute code without authentication. Bugs extend their scope at runtime and force affected installations to be reviewed and updated, a recommendation that PHP makes directly.
The integrated disclosure began to get confusing on October 20. As reconstructed by the PHP Foundation, around 15:00 UTC the identifiers of the two CVEs began to circulate, albeit without technical details and with incorrect information, which pushed the project forward of the planned release by a day. A video with a limited demo from Calif then accidentally appeared, and at 07:41 UTC on the 21st, Chainguard posted images incorporating the fix before ending the ban. None of these familiar episodes explain, however, what happened four days ago.
What came next is much easier to follow. Cloudflare ranged from registering thousands of exploit attempts in the ten hours before the announcement, to a few thousand in the first 45 minutes, to a few thousand in two hours and eventually to millions, according to figures compiled by Reuters, its CEO, Matthew Prince. The company also observed how attackers modified their payloads Try to avoid deploying protection. In parallel, Amazon noticed a rapid expansion of exploitation: new proof-of-concepts appeared and, once the ban was lifted, they began to be used against its sensors almost immediately.
At this point we can reconstruct almost the entire sequence: we know when the flaws were discovered, how they worked to correct them, when the ban began to deteriorate, and how quickly efforts escalated as more details were disseminated. What is still missing is precisely the beginning of that story. Amazon saw activity consistent with an exploit attempt on October 17, when there wasn’t yet enough public explanation to arrive. Who was behind it and above all how he acquired that knowledge remain open questions.
Picture | Mohammad Rahmani
In Xataka | The first visible impact of AI in the real world is cyber security: it has completely changed shape and form
