Exploit Attempt Targeting PHP2Shell Vulnerabilities Detected Four Days Before Public Disclosure

Amazon's Threat Intelligence team detected an exploit attempt targeting newly disclosed PHP2Shell vulnerabilities four days before their public release. The attack originated from an IP linked to a commercial anonymization network, highlighting ongoing exploitation risks post-patch.

Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.

"The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses,

Read original article