Datadog independently reproduced CVE-2026-109618 on PHP 8.5.11 with unauthenticated HTTP POST; attack runs before application code. AWS reported exploitation attempts as early as October 17, four days before public disclosure. Community mitigations such as session.upload_progress.enabled=0 do not fully protect; only patching is a complete fix.