Amazon says PHP2Shell exploitation began 4 days before patches

Amazon Threat Intelligence researchers discovered that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were made available. The exploitation predates the official patch release, indicating a zero-day or near-zero-day attack window. Amazon was involved in tracking and reporting this threat activity. The article highlights the risk of pre-patch exploitation, where threat actors may have had prior knowledge of the vulnerabilities. This type of activity underscores the importance of rapid patch deployment and proactive threat monitoring. The PHP2Shell flaws were patched on a Wednesday, meaning exploitation began the preceding Saturday. The early exploitation window could have allowed attackers significant time to compromise systems before defenders had any mitigation available.