News
cybersecurity ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More - The Hacker News cybersecurity Arista patches new VeloCloud Orchestrator zero-day exploited in attacks - BleepingComputer cybersecurity Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes - The Hacker News threat-intel Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year - GBHackers cybersecurity PHP2Shell: 24 hours in, 99.3% of Measurable PHP Instances Are Still Unpatched - OX Security cybersecurity Hackers got a four-day head start on epic PHP2Shell vulnerability - Ars Technica Security cybersecurity Node.js Brotli Decoder Out-of-Bounds Write (RCE) – CVE-2026-111497 - OX Security cybersecurity Hacker Conversations: Corey Thuen and the Evil Bit - SecurityWeek cybersecurity Machine speed attacks require machine speed detection and response - BleepingComputer cybersecurity INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown - The Hacker News threat-intel Cybercriminals Used Claude and Grok to Launch Automated Attacks Against Banks - GBHackers cybersecurity Amazon says PHP2Shell exploitation began 4 days before patches - BleepingComputer threat-intel ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors - Wiz Research threat-intel K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign - GBHackers cybersecurity Signal Vulnerability Lets Malicious Callers Block Hang-Ups - SecurityWeek
1 / 15
All news ›
Cybersecurity

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services

Pro CISO ·

Amazon Threat Intelligence found attempts to exploit the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in its MadPot honeypot network starting October 17, four days before public disclosure. The attempts came from an anonymization network, and it is unclear how the attacker obtained the exploit details. Once the patch was released, working proof-of-concept exploits appeared within hours and were used broadly in the wild, so organizations should patch quickly and investigate from the earliest known exploitation date.

Continue on Pro CISO ↗ ‹ All news Get the newsletter

The summary and image come from Pro CISO; the image is shown from their website.