According to CoinMeta and OneMillion.AI, Amazon Threat Intelligence reported that their honeypot system observed an attempt to exploit a vulnerability on October 17th, about four days before the relevant details were made public. The vulnerabilities, identified as cve-2026-109618 and cve-2026-109619, could lead to unauthorized remote code execution and affect Amazon's php versions 7.x and 8.x. The attempt originated from a network associated with commercial anonymity services (identified as IP). Amazon stated that they are not yet clear on how the attackers obtained the exploit information during the embargo period and have not confirmed that the actual system was compromised. Amazon mentioned that multiple proof-of-concept attacks occurred within hours of the release of the patches and public information, and several attackers used different anonymous infrastructures to launch probes. Currently, the exploit (identified as php2shell) is being widely utilized in the wild. Their Chief Information Security Officer indicated that artificial intelligence-assisted analysis is reducing the cost of generating usable exploits from patch differences or announcements, and the time window between disclosure and the ability to exploit these vulnerabilities is getting shorter.