# Source: Amazon says PHP2Shell exploitation began 4 days before patches

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

BleepingComputer: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Amazon says PHP2Shell exploitation began 4 days before patches

**BleepingComputer** · [https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/](https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/) · published not stated · added by `curator@php.newsroom` · slug `bleepingcomputer-amazon-4-days-before`

Promoted from the source watch (oq9gflln), snapshot 20261023T012042Z. Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "unclear how man...

## What it says, as the collector read it

#### Amazon says PHP2Shell exploitation began 4 days before patches

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/tech-press/bleepingcomputer/amazon-4-days-before`, snapshot `20261023T012042Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T012042Z/provenance.json`. Publisher: BleepingComputer. Language: en. URL: https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/

#### What the page says

_Curator's reading of the capture._

BleepingComputer: Amazon Threat Intelligence says the first exploitation attempts began on 17 October, four days before the patches, from a commercial anonymisation network, and that multiple proof-of-concept exploits were used from VPN addresses hours after disclosure, apparently by several actors; "it's unclear if any of these attempts would have succeeded in real-world systems", yet PHP2Shell is "now being broadly exploited in the wild". It says Cloudflare, watchTowr, Previdian, Hadrian and Patchstack detected unsuccessful exploitation attempts before disclosure, that the PHP team said pre-patch PoCs were not functional, and quotes Dataminr's TRACE team: activity since disclosure "remains limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises". VirusTotal tracks more than 5.1 million PHP hosts, about 3.8 million with a port open.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): "unclear how many attacks are successful"

Supports: data/compromise.json on the site (/compromise/)

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T012042Z · HTTP 200 · https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/- `headers.json` 668fb6eaa9fed6428617810fa613ea89128912ab5a69ca9b6b07745619eca389 1,034 bytes
- `page.html` e0b6621a06d202fe071370cdaabe66d71c2f5140fa24ed84944ee545eadc0c0c 90,448 bytes
- `provenance.json` 4b9107ed9dfda71ba900872536cb9a543352733b8b9cf058ac39652728d7ff33 1,732 bytes
- `rendered.html` af0f5bafbd31cd2f15782a44bb16120c0356bcb9d0b4b1023880e8c5fa904d4e 150,348 bytes
- `screenshot.jpg` cd8f6c7adbf3fd996cf0fa8b8fc6045875dc12132019c0dcf9440db26e55862d 518,677 bytes
- `text.txt` 2978662261ce3880962943cd129485066fab46e3bc7a181762dbe83479aa8997 5,970 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/bleepingcomputer-amazon-4-days-before/index.html