# Source: Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Europa Press: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche

**Europa Press** · [https://www.europapress.es/portaltic/ciberseguridad/noticia-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105435.html](https://www.europapress.es/portaltic/ciberseguridad/noticia-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105435.html) · published 2026-10-23T10:54:35+02:00 · added by `curator@php.newsroom` · slug `europapress-portaltic-ciberseguridad-noticia-amazon`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T232528Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Europa Press (Spanish), 23 October: Amazon detected attempts to exploit PHP2Shell days before the vulnerabilities and their patch were disclosed, acco...

## What it says, as the collector read it

#### Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `es/news/europapress/portaltic-ciberseguridad-noticia-amazon-detecto-intentos-exp`, snapshot `20261023T232528Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T232528Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Europa Press (Spanish), 23 October: Amazon detected attempts to exploit PHP2Shell days before the vulnerabilities and their patch were disclosed, according to an Amazon Threat Intelligence report; The PHP Group published the two critical flaws, CVE-2026-109618 and CVE-2026-109619, on 21 October and released the urgent security update that day.

> Actores de amenazas intentaron explotar las vulnerabilidades críticas identificadas en el ecosistema PHP, conocidas como PHP2Shell, días antes de que se hicieran públicas el pasado miércoles, como se desprende de un informe de Amazon Threat Intelligence.

_Curator's translation:_ "Threat actors tried to exploit the critical vulnerabilities identified in the PHP ecosystem, known as PHP2Shell, days before they were made public last Wednesday, as an Amazon Threat Intelligence report shows."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche". Selected mechanically, not read by a person.

#### Capture notes

Language `es`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T232528Z · HTTP 200 · https://www.europapress.es/portaltic/ciberseguridad/noticia-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105435.html- `headers.json` 69bca1bdc9486e74b95a513051c6ee5b1a68d677f832461a32dcba0eacef3ad9 792 bytes
- `page.html` 1861c2f91676e6ebd49f1d2a3106249afa2ef1091f1a9085ae744e3fc591cdaa 267,771 bytes
- `provenance.json` b1e0e7394c4540fc1c0e6410f0a3a27a2a2ca5bbdeaa82ac094e2155d4866a45 1,983 bytes
- `rendered.html` 164da68d36f4a801d8bda3a4a1e69a45475628882b4a431955b395f8aa74cddc 625,916 bytes
- `screenshot.jpg` 2451b349fbd9f5a65d58f99b0f2239b0da5e74f2c7c90df73a76624fdc4bd9a6 607,999 bytes
- `text.txt` a3d0f225217dc3a6578a656f30d6438fd0e87e35c0c54896e74e09ed2c7968a6 7,999 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.18.2 · data as of 2026-10-24T16:05Z · vault commit 8c16a64a7cf6 · https://php.oct.2026.newsroom.sgit.ai/sources/europapress-portaltic-ciberseguridad-noticia-amazon/index.html