Amazon Detected PHP Flaw Exploitation Four Days Before Public Disclosure

Amazon Threat Intelligence says it detected exploitation of the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 on October 17, 2026, four days before public disclosure. The attempt targeted a MadPot honeypot, Amazon's decoy monitoring system, from an anonymized IP address. Amazon's findings point to a threat actor rather than automated scanning alone.