CriticalCVE-2026-109618CVE-2026-109619 7 Hunt LeadsIOCsRemote AttackerMiraiAmazon Threat Intelligence (AWS Security Blog)
PHP2Shell Was Being Exploited Four Days Before Anyone Knew
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.