Hackers Exploited PHP2Shell Flaws Days Before Public Disclosure

Summary

Amazon Web Services logged attempts to exploit the PHP2Shell vulnerabilities four days before the patches were released on Wednesday. Its Threat Intelligence team said it detected an attempt on October 17, 2026, against its MadPot honeypot service, and that the attempt came from an IP address associated with a commercial anonymization network. The flaws are now being "broadly exploited" across the internet following the patch release. The Register reports that Cloudflare has seen millions of exploit attempts, and The Verge, citing an Amazon Threat Intelligence report by CJ Moses, Amazon's chief information security officer, says the security team found the October 17 attempt through a monitoring system designed to bait hackers.

Timeline

1. WIRED

   22 Oct 2026, 02:24 UTCSource ↗

   WIRED reports that Amazon Web Services logged attempts to leverage the PHP2Shell bugs four days before the patches, and that the bugs are now being broadly exploited across the internet.

2. The Hacker News

   22 Oct 2026, 06:34 UTCSource ↗

   The Hacker News reports that Amazon's Threat Intelligence team detected an attempt to exploit the PHP2Shell vulnerabilities dating back to October 17, 2026, against its MadPot honeypot service, and that the attempt came from an IP address associated with a commercial anonymization network.

3. The Register

   22 Oct 2026, 12:15 UTCSource ↗

   The Register reports that Cloudflare has seen millions of exploit attempts against PHP2Shell, while Amazon spotted attackers trying to exploit the flaws four days before the patches landed.

4. BleepingComputer

   22 Oct 2026, 13:09 UTCSource ↗

   BleepingComputer reports that Amazon Threat Intelligence researchers say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday.

5. The Verge

   22 Oct 2026, 16:49 UTCSource ↗

   The Verge reports, citing an Amazon Threat Intelligence report, that the company's security team found a PHP2Shell exploit attempt on October 17 through a monitoring system designed to bait hackers, days before the flaws were patched.