REPORTED DEVELOPMENT
Threat report: 21 October; WAF update: 22 October.
Amazon Threat Intelligence's 21 October report describes MadPot observations of a first PHP2Shell attempt on 17 October, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. Further attempts occurred from 02:00-08:00 UTC on 21 October before 14:00 disclosure, followed by rapid spread. These were sensor-observed attempts, not demonstrated successful business-system compromises.
AWS's 22 October WAF update makes PHP rules version 2.3 default. PHP2Shell_BODY specifically covers CVE-2026-109619; customers pinned to older rules do not automatically receive it. AWS says WAF does not replace PHP updates, the complete correction for both vulnerabilities.
WHY IT MATTERS TO THE MARKET
This updates exploitation evidence for existing vulnerabilities rather than introducing new ones. Exposure timelines, prevention, monitoring, incident response and demonstrated losses remain distinct.