Amazon Says PHP2Shell Exploitation Began 4 Days Before Patches

Amazon says PHP2Shell exploitation began 4 days before patches

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.

The disastrous PHP vulnerabilities were exploited days before the patch

Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence. CJ Moses, Amazon chief information security officer, writes that the company's security team found a PHP2Shell exploit attempt on October 17th through a monitoring system designed to bait hackers, as reported earlier by Wired and Bleeping Computer. On Wednesday, websites scrambled to appl…

PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports

AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive.… Read more →

PHP2Shell Exploitation Started Days Before Patches

Initial PHP2Shell exploitation was observed four days before patches landed, and many servers run outdated PHP versions.

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network,