Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page gb/tech-press/the-register/hackers-pile-on-php2shell, snapshot 20261023T012042Z. Copied byte for byte; every file's sha256 is in captures/20261023T012042Z/provenance.json. Publisher: The Register. Language: en. URL: https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749

What the page says

_Curator's reading of the capture._

The Register: Amazon Threat Intelligence detected an attempt to exploit PHP2Shell on 17 October, four days before patches, through MadPot, its honeypot network, from an anonymised IP address; Amazon says it is unclear how the actor got exploit information under embargo. Hadrian reported on 21 October that PHP2Shell was being "exploited in the wild at scale". The article reports attempts; it names no organisation as compromised.

Why it is here

From the promotion queue (index/promote.json, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): Hadrian "exploited in the wild at scale"

Supports: data/compromise.json on the site (/compromise/)

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.