GoKawiilAWS finds PHP2Shell exploit attempts dated October 17, before public patch
Amazon Web Services researchers reviewing honeypot logs found that an attacker attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before the flaws were publicly disclosed and patched on Wednesday. The attempt originated from an IP address linked to a commercial anonymization service, and AWS also logged a wave of further exploitation attempts in the hours before the official disclosure at 10 am ET.
GoKawiil's interpretation of the reporting above, not reported fact.
The finding suggests some attacker had access to exploit details while the vulnerability was still under embargo, raising questions about how disclosure information leaked ahead of schedule, according to AWS CISO CJ Moses. This could indicate gaps in coordinated-disclosure security practices across the industry, potentially prompting researchers and vendors to reassess how embargoed vulnerability data is shared and protected before patches go live.
- AWS honeypot logs show PHP2Shell exploitation attempts dated October 17, four days before public disclosure.
- The early attempt came from an IP tied to a commercial anonymization network, complicating attribution.
- Additional exploitation attempts hit AWS honeypots in the hours just before Wednesday's official 10 am ET disclosure.
Source: wired.com — Lily Hay Newman, 2026-10-22
Published there as: “Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.