Source · news · secondary · captured

Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

The Hacker News (Ravie Lakshmanan) · https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html · published 2026-10-22 · added by collector-researchers · slug thehackernews-php2shell-4days

Dated Oct 22, 2026. Quotes Amazon CISO CJ Moses ('post shared with The Hacker News'): MadPot honeypot exploit attempt Oct 17 2026 from anonymization network IP geolocated to Australia; PoC attempts from ~02:00 UTC Oct 21. Says 'details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time' — contrast PHP Foundation 'No technical details leaked'. VulnCheck: PHP on 2,608,039 internet-facing hosts.

PHP is exposed on about 2.6 million internet-facing hosts,…Frontier AI found the flaw ahead of attackers, giving defe…An exploit attempt hit an Amazon honeypot on 17 October fr…2026-10-17: An exploit attempt from an anonymisation-netwo…2026-10-21 02:00 UTC: Amazon sees proof-of-concept attempt…2026-10-21 08:36 UTC: ELLIO records its first sensor hit.2026-10-22: The Hacker News publishes Amazon's account of …2,608,039 internet-facing hosts running PHP4 days before disclosure, an exploit attempt hit an Amazon…THN

What it says, as the collector read it

The Hacker News: Amazon saw a PHP2Shell exploit attempt 4 days before disclosure

  • Ravie Lakshmanan, Oct 22, 2026. Captured 08:13:20Z.
  • CJ Moses (CISO, Amazon Integrated Security), "in a post shared with The Hacker News": "The exploit attempt originated from an IP address associated with a commercial anonymization network ... While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure." Date Oct 17, 2026, MadPot; IP geolocated to Australia (IOC omitted here).
  • Amazon: PoC attempts from ~02:00 UTC Oct 21, then six hours of attempts from anonymised infrastructure; "multiple threat actors".
  • ELLIO: first sensor hit Oct 21 08:36 UTC.
  • Leak wording differs: THN says "details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time"; PHP Foundation said "No technical details leaked" (with the CVE IDs), the video came later.
  • Size: VulnCheck counts PHP on 2,608,039 internet-facing hosts — a far smaller, host-based number than "70% of websites" or "30 million websites".
  • Primary AWS post not yet found (THN does not link one). The AWS Security Blog post is still to be located.

Claims that cite it

ClaimWho says itStatusPrimarySources
PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 million unpatched on 21 October
Censys: 2.58 million hosts seen, 1.58 million reporting a version, 1.57 million not patched; nearly 3 million by 22 October. VirusTotal: 5.1 million IPs running PHP, 1.1 million announcing a version. Unit 42: 22.6 million systems that 'could be vulnerable' (via Insurance Business). Censys's own post was not found.
VulnCheck and Censys, via The Hacker News and SecurityWeekreported0/2THN SecurityWeek
Frontier AI found the flaw ahead of attackers, giving defenders time to prepare
Amazon reports an exploit attempt against a honeypot on 17 October, four days before disclosure, from an actor whose source of exploit information is unknown.
OpenAIdisputed1/2OpenAI on X THN
An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; proof-of-concept attempts began about 02:00 UTC on 21 October from multiple actors; after release 'PHP2Shell is now being broadly exploited in the wild'
Primary party. Amazon adds: 'it's unclear if any of these attempts would have succeeded in real-world systems'. Attempts against honeypots, not compromises of victims.
Amazon (CJ Moses, AWS Security Blog)reported1/2Amazon THN

Events that cite it

WhenEventTime is
2026-10-17An exploit attempt from an anonymisation-network IP hits an Amazon MadPot honeypot.stated
2026-10-21 02:00 UTCAmazon sees proof-of-concept attempts, then six hours of attempts from anonymised infrastructure.stated
2026-10-21 08:36 UTCELLIO records its first sensor hit.stated
2026-10-22The Hacker News publishes Amazon's account of the 17 October honeypot attempt and VulnCheck's count of 2,608,039 hosts.stated

Numbers from this source

FigureOfStatus
2,608,039internet-facing hosts running PHPreported
4 daysbefore disclosure, an exploit attempt hit an Amazon honeypotreported

Exploitation signals from this source

The bytes

capture 20261022T081320Z · HTTP 200 · https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html
  • headers.json 54c094189f50f4afa3962d0e484ef93cf0f92bd1fefb71ae2fec7e63b71b3b14 783 bytes
  • page.html b2b51b3736eab8ebf9fb584770654a563ec0cde9a258c8ccc9b2cac5e2759495 181,180 bytes
  • provenance.json ef03914e372ab683b87cf258b84ec703ba5cc140e8b724fe1fa547d0f7a066fe 1,081 bytes
  • rendered.html a7caeb00fddc406d6dcfeb68c7fdce453fdb39446eb83daa364cb3f2986a7834 176,478 bytes
  • screenshot.png 71b28408de124895b1534822f79eff33a445be5296c09203d51f152ef67d089c 2,255,956 bytes
  • text.txt c1cb63141287484c7b96b6f842f983bb978a108b3b82eebb95ebe78c4ed608f4 12,295 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →