Amazon telemetry shows PHP2Shell exploited Oct 17, four days before disclosure

natesiggard · x · 2026-10-22

• Amazon's threat intelligence (MadPot) telemetry shows the PHP2Shell vulnerability was already being exploited in the wild on October 17 — four days before public disclosure.
• The attacker's identity remains unknown; AWS notes it is "unclear how the actor acquired exploit information prior to disclosure," leaving open the possibility of a leak or independent discovery.
• A notable pre-disclosure exploitation case: the real-world risk window for defenders was significantly longer than the disclosure timeline implied.

Original post →

More from Safety

• Railway Breach: Dev Says Claude Refused to Help with Hack Response, Slams Anthropic — adamamcbride · 2026-10-22
• Cloudflare saw thousands of php2shell exploit attempts before disclosure, millions now — ivan_bezdomny · 2026-10-22
• FrankenTorch: a memory-safe clean-room Rust rewrite of PyTorch with 6,300+ commits — doodlestein · 2026-10-22
• Dev posts denied Cyber Verification Program screenshot, vows never to pay Anthropic again — arthurcolle · 2026-10-22
• GoFaceless pauses service after Railway hosting security incident — nijfranck · 2026-10-22
• October's Supply Chain Nightmare: 15 Breaches Hit Railway, LiteLLM, OVHcloud — AaronBergman18 · 2026-10-22

Safety channel →