# Source: PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

SiliconANGLE: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE

**SiliconANGLE** · [https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/](https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/) · published 2026-10-22T23:27:27+00:00 · added by `curator@php.newsroom` · slug `siliconangle-2026-10-22-php2shell-attacks-began-four`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T160435Z, queue priority 3 (mechanical selection by researcher@php.newsroom, read by the curator). SiliconANGLE, 22 October: Attackers began targeting the PHP2Shell vulnerabilities four days before the patches, Amazon disclosed, and exploit attempts...

## What it says, as the collector read it

#### PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `lt/news/siliconangle/2026-10-22-php2shell-attacks-began-four-days-before-patches`, snapshot `20261023T160435Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T160435Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

SiliconANGLE, 22 October: Attackers began targeting the PHP2Shell vulnerabilities four days before the patches, Amazon disclosed, and exploit attempts seen by Cloudflare have since climbed into the millions. It says PHP's maintainers shipped fixes on Wednesday after details leaked, and that the bugs had sat in PHP's code for years until an August audit financed by OpenAI used an AI model to show they could be exploited.

> Attackers began targeting the critical PHP2Shell vulnerabilities four days before patches were released, Amazon.com Inc. has disclosed, while exploit attempts seen by Cloudflare Inc. have since climbed into the millions.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 3): Mentions CVE-2026-109618/109619 or php2shell: "PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions - SiliconANGLE". Selected mechanically, not read by a person. Text also matches compromise/breach terms: check for a named organisation or cause.

#### Capture notes

Language `en-US`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T160435Z · HTTP 200 · https://siliconangle.com/2026/10/22/php2shell-attacks-began-four-days-before-patches-amazon-says-as-attempts-hit-millions/- `headers.json` f679f363bdb6ceb4cbf592bbdaa119594435a71852cc91500bc2876a2e0cc066 692 bytes
- `page.html` 93efa7ec542828a79d8323a9cd649fb2e6f0ebf0b1f33ef2db2d07f8688d0781 183,203 bytes
- `provenance.json` 5a2eb385e610b58cadb52127dc58577ddf9aa4fc62465e1aeeda07c18d25fab0 1,721 bytes
- `text.txt` bfad1c9512cf702bd764da66e5ce5bdc3e602ec3a8c87826b2ad7fc85bda6f77 9,686 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.14.5 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/sources/siliconangle-2026-10-22-php2shell-attacks-began-four/index.html