Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED

Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched | WIRED

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page us/tech-press/wired/exploited-days-before-patched, snapshot 20261023T012042Z. Copied byte for byte; every file's sha256 is in captures/20261023T012042Z/provenance.json. Publisher: WIRED. Language: en. URL: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/

What the page says

_Curator's reading of the capture._

WIRED: research published by AWS on the evening of 21 October shows at least one actor attempted to exploit PHP2Shell on 17 October, seen on an AWS honeypot from a commercial anonymisation network; in the hours before disclosure AWS honeypots were hit by multiple attempts from several apparent actors, and AWS CISO CJ Moses says it is unclear whether any would have succeeded on real systems while also saying PHP2Shell "is now being broadly exploited". The headline says the flaws were "exploited" days before the patch; the body describes attempts. PHP Foundation executive director Elizabeth Barron: "to our knowledge, there has been no successful attempt at remote code execution." Moses argues AI is shrinking the time from patch to working exploit.

Why it is here

From the promotion queue (index/promote.json, priority 1): Break-in question (editor, 22 October): one of the reports read for the statement on /compromise/ ("no named organisation has said it was compromised through php2shell"). Break-in question (editor, 22 October 20:49 UTC): PHP Foundation: no successful RCE to its knowledge; Amazon: unclear whether attempts would succeed

Supports: data/compromise.json on the site (/compromise/)

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.