Exploit attempts hit 4 days before disclosure: Cloudflare logs millions of PHP scans
IgorCarron · x · 2026-10-22
Amazon caught PHP2Shell exploit attempts on an AWS honeypot on Oct 17, four days before AI-discovered PHP flaws were publicly disclosed, from an anonymized IP. Cloudflare saw thousands of attempts 10 hours before disclosure, tens of thousands 45 minutes after, hundreds of thousands in 2 hours, then millions. Censys found 1.5M of 2.6M identified PHP hosts running versions with no patch available.
Related event: PHP2Shell Exploited Four Days Before Public Disclosure(2 posts)→
More from Safety
- AI uncovers long-hidden PHP vulnerability, lowering the bar for exploit discovery — FuSheng_0306 · 2026-10-22
- Where should agent autonomy end? The gray zone beyond blocking dangerous APIs — Innowise_ · 2026-10-22
- CrowdStrike CEO: Adversaries Already Run AI Agents, Fastest Attacks Play Out in Seconds — No Priors · 2026-10-22
- Indian cert body SCK flagged: certificate not found in its own registry, no email or landline, just 2 mobile numbers — kingslyj · 2026-10-22
- Researcher uses Grok to surface 227 suspected UAE bot accounts overnight — FlorianGallwitz · 2026-10-22
- Meta's $25B privacy penalty reprices the data asset its AI capex demands — VectorWireAI · 2026-10-22