Amazon Spotted PHP Flaw Exploitation Four Days Before Disclosure

Amazon Threat Intelligence says it detected exploitation of critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 on October 17, 2026, four days before public disclosure. The attempt targeted MadPot, a honeypot (a decoy system that monitors attackers) run by Amazon, and came from an anonymized IP address. Amazon's findings point to a threat actor rather than automated scanning alone.