Amazon says PHP2Shell exploitation began 4 days before patches

Amazon says PHP2Shell exploitation began 4 days before patches

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page us/tech-press/bleepingcomputer/amazon-4-days-before, snapshot 20261023T012042Z. Copied byte for byte; every file's sha256 is in captures/20261023T012042Z/provenance.json. Publisher: BleepingComputer. Language: en. URL: https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/

What the page says

_Curator's reading of the capture._

BleepingComputer: Amazon Threat Intelligence says the first exploitation attempts began on 17 October, four days before the patches, from a commercial anonymisation network, and that multiple proof-of-concept exploits were used from VPN addresses hours after disclosure, apparently by several actors; "it's unclear if any of these attempts would have succeeded in real-world systems", yet PHP2Shell is "now being broadly exploited in the wild". It says Cloudflare, watchTowr, Previdian, Hadrian and Patchstack detected unsuccessful exploitation attempts before disclosure, that the PHP team said pre-patch PoCs were not functional, and quotes Dataminr's TRACE team: activity since disclosure "remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises". VirusTotal tracks more than 5.1 million PHP hosts, about 3.8 million with a port open.

Why it is here

From the promotion queue (index/promote.json, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "unclear how many attacks are successful"

Supports: data/compromise.json on the site (/compromise/)

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.