Amazon Threat Intelligence identified an attempted PHP2Shell exploit against its MadPot honeypot on October 17, 2026, before the public disclosure of CVE-2026-109618 and CVE-2026-109619. Cisco Talos later reported mostly scanning and uncoordinated attempts to deliver payloads. The honeypot activity and Talos’s observations are reports of attempts, not confirmed compromises of production PHP servers.
Amazon’s MadPot recorded activity before disclosure
Amazon Threat Intelligence said the October 17 attempt came from an IP address associated with a commercial anonymization network. MadPot is a honeypot, a decoy system designed to attract and study malicious activity. Amazon also reported additional attempts against MadPot from anonymized infrastructure between 02:00 and 08:00 UTC on October 21, before the disclosure window opened at 14:00 UTC.
The Amazon Threat Intelligence account describes attempts against its honeypot. It does not report a successful compromise of a production system.
Talos’s observations came from a separate monitoring window
Cisco Talos said it had not observed exploitation in the wild as of 14:00 UTC on October 21. In its October 22 update, Talos reported attempts within hours of disclosure, mostly scanning and some uncoordinated payload delivery. Its initial assessment was time-stamped to its own observations; Amazon’s separate MadPot account identified an earlier attempt dated October 17.
Talos did not report that the later scanning or payload attempts succeeded. The distinction matters for operators: observed attack traffic is not, by itself, evidence that a server was compromised.
The two flaws affect PHP core
CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote-code-execution vulnerabilities in PHP core. Remote code execution means an attacker may be able to make a server run code through a request. Talos says both flaws affect PHP builds dating back to version 5.4 and can be reached before application code runs. It assigns each a CVSS v4.0 score of 9.2.
The flaws involve different memory-handling failures. CVE-2026-109618 can interrupt request processing during an out-of-memory condition, leaving data partly initialized before cleanup. CVE-2026-109619 involves stale internal state being reused after its backing memory has been freed.
Fixed PHP releases and temporary controls
CERT-EU listed PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as fixed releases on October 21. NeoTeo covered the release in its earlier report on PHP’s security fixes.
Talos describes temporary settings such as memory_limit=-1 and session.upload_progress.enabled=0 for specific attack paths, but says interim controls do not provide comprehensive protection. It recommends upgrading to a fixed release. Talos also says PHP 8.1 and older are end of life; CERT-EU notes minimal source backports for PHP 7.4, 8.0 and 8.1, and that some vendors may provide backported fixes.
