Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R03 Exploitation outpaces patching / R03-1

R03-1: Attempts before disclosure

Because an exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network, someone may have had the flaw before the leak, resulting in compromises that pre-date every advisory and every log review window.

Rating 15 high · Likelihood 3 Possible · Impact 5 Severe · Kind Security · Acceptance not recorded

Basis. One attempt reported by Amazon; Imperva saw nothing matching before disclosure.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

Stakeholder	Part	Why	Its register
Threat intelligence and detection	informer	The honeypot evidence and its absence elsewhere.	4 risks
Security lead and AppSec	owner	Decides how far back to look in the logs.	6 risks

What it arises from

Exploitation that cannot yet be seen. Honeypots and edge networks see attempts; nobody has shown a compromise, and KEV waits for one. Absence of evidence is read as safety.

The evidence

Claim	Status	Fact-check	Sources
An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; proof-of-concept attempts began about 02:00 UTC on 21 October from multiple actors; after release 'PHP2Shell is now being broadly exploited in the wild'	reported	A2 Reported	Amazon THN
No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosure monitoring	reported	A2 Reported	Imperva Threat Research

Treatments

Treatment	Status	Where
Hunt back to 17 October, not to the release	partial	Detection and defence: what blocks php2shell and what shows it

The standards that govern it

Framework	Control	What it asks	Family
NIST CSF 2.0	ID.RA-02	Threat intelligence is received from information sharing forums and sources	Frameworks and control catalogues
ISO/IEC 27001	A.5.7	Threat intelligence	Management-system standards
NIST SP 800-53	SI-4	System monitoring	Frameworks and control catalogues
PCI DSS	12.10.1	An incident response plan exists and is ready to be activated	Management-system standards

The stories that tell it

Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit
Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third (through Exploitation outpaces patching)
php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof (through Exploitation outpaces patching)

On this site: Exploitation signals, in order