PHP2Shell Exploited 4 Days Before Disclosure [2026]

PHP2Shell Exploited 4 Days Before Disclosure [2026]

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page io/news/shattered/php2shell-attacks-began-4-days-before-disclosure-2026, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

shattered.io (English): a rewrite of The Register's 22 October report. Amazon Threat Intelligence spotted a PHP2Shell exploitation attempt on 17 October 2026, four days before disclosure, in its MadPot honeypot network, from an IP tied to a commercial anonymisation network; the embargo was due to end at 14:00 UTC on 21 October; Amazon then saw multiple proof-of-concept exploits. A secondary source for what the vault holds from the primary reports.

> Amazon Threat Intelligence spotted a PHP2Shell exploitation attempt on October 17, 2026, The Register reported on October 22.

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ Shattered.io (English) analyses AWS's report of a PHP2Shell attempt on 17 October in MadPot, gives a timeline from the AWS blog and The Register, and discusses how an actor could have known during the embargo.

Why it is here

From the promotion queue (index/promote.json, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell Exploited 4 Days Before Disclosure [2026]". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

Capture notes

Language en-US. Nothing in the page addresses an AI or hides text from a reader.