# Source: Attackers Were Already Testing PHP2Shell Exploits Before Security Patches Arrived > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. Cyber Press: what it says, the claims and events that cite it, and the hashes of every captured file. Source · news · secondary · captured # Attackers Were Already Testing PHP2Shell Exploits Before Security Patches Arrived **Cyber Press** · [https://cyberpress.org/php2shell-exploits-predate-patches/](https://cyberpress.org/php2shell-exploits-predate-patches/) · published 2026-10-22 · added by `curator@php.newsroom` · slug `cyberpress-php2shell-exploits-predate-patches` Promoted from the source watch (oq9gflln), snapshot 20261023T080331Z, selected by curator@php.newsroom from the 08:30 UTC pass (not from the queue). A secondary report of Amazon's honeypot findings: the earliest exploitation attempt hit Amazon's MadPot telemetry on 17 October, four days before disclosure, fr... ## What it says, as the collector read it #### Attackers Were Already Testing PHP2Shell Exploits Before Security Patches Arrived Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `au/news/cyberpress/php2shell-exploits-predate-patches`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes. #### What the page says _Curator's reading of the capture._ A secondary report of Amazon's honeypot findings: the earliest exploitation attempt hit Amazon's MadPot telemetry on 17 October, four days before disclosure, from an IP linked to a commercial anonymisation network; the embargo was due to end at 14:00 UTC on 21 October; the first proof-of-concept exploits Amazon saw appeared around 02:00 UTC that day. Investigators have not established how the attacker got exploit information, nor whether the attempts would have compromised real systems. > investigators have not established how the attacker obtained exploit information before disclosure. #### Why it is here Not from the promotion queue. The editor asked the curator, in its session on 23 October 2026, to start from the watch's 08:30 UTC pass while the researcher queued it, and approved this batch of fifteen. Selected mechanically: an article page of the watch, snapshot newer than the queue (23 October 02:20 UTC), text that names php2shell or one of the two CVE IDs, URL not already in this vault, English, and naming an organisation or a cause. Nobody has ranked it: if the researcher's queue later lists this URL, it is already here under this slug. #### Capture notes Language `en`; the text extract is the watch reader's, the page as served is in `captures/20261023T080331Z/page.html`. Nothing in the page addresses an AI or hides text from a reader. ## Claims that cite it No claim cites this source yet. ## Events that cite it No timeline event cites this source yet. ## The bytes capture 20261023T080331Z · HTTP 200 · https://cyberpress.org/php2shell-exploits-predate-patches/- `headers.json` 20c04a3d41af56d86347bb820ae1b3865f963eafe5fd3bb50b175cd0cc0bd4e0 776 bytes - `page.html` 001fe3a7eb405f7bf74d993215bc7a52d562588957aa9705bc0e07e910ca5157 359,318 bytes - `provenance.json` ea60f0b4e9e23765027dafd072ec31be85645474041e5e4f730ef9a9f5fc7180 1,661 bytes - `rendered.html` 00e7c15d9a47cf033cb43272da3ba496ab76779223e5fff60dc4240ba78557ac 951,809 bytes - `screenshot.jpg` 61cab329704a88f174646719bcd1551995d92a24acc0296662d58141c0a7cf28 548,378 bytes - `text.txt` 89f109c027b1ff22badfe13405d7857d8b07cd088afa1d99799fcb33226cc3bc 7,029 bytes The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html) --- site v0.14.5 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/sources/cyberpress-php2shell-exploits-predate-patches/index.html