Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team detected an exploitation attempt against PHP2Shell vulnerabilities on October 17, 2026, four days before they were publicly disclosed. The attempt was observed via Amazon's MadPot honeypot service. The exploit originated from an IP address linked to a commercial anonymization network. The vulnerabilities have since come under broad exploitation in the wild following patch release. The discovery highlights the existence of pre-disclosure exploitation activity, suggesting threat actors may have had prior knowledge of the flaws. CJ Moses from Amazon commented on the findings.