Hackers Exploited PHP2Shell Flaws Four Days Before Patches

AWS found attempts to exploit the critical PHP2Shell vulnerabilities on October 17, four days before patches were published on October 21. The activity came from an IP tied to a commercial anonymization network, suggesting a deliberate threat actor.

• AWS honeypot logged the exploitation attempt on October 17
• PHP2Shell patches were released October 21 at 10 am ET
• The attack came via a proxy or VPN anonymization network
• AWS: AI is shrinking the time from patch to working exploit