Follow-up on PHP2Shell: Amazon says its honeypots caught the first exploit attempt on October 17, four days before PHP shipped the patches. Cloudflare, watchTowr and Patchstack saw early probes too.
Details had leaked during the embargo, which is why PHP pushed the release forward. Nobody knows yet how the attacker got them. Public proof-of-concepts showed up within hours of the patch.
So "patch on release day" was already late this time. What still helps:
- update now if you haven't: 8.5.12, 8.4.27, 8.3.36 or 8.2.35
- don't rely on the config workarounds, Datadog says they don't fully cover it
- check logs from Oct 17 onward, not just from the disclosure
The gap between disclosure and exploitation keeps shrinking. This time it was negative.
https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-23 10:34:59 UTC
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-23 10:34:59 UTCEvent JSON
{
"id": "03461dcacef1b406e6a4863a1c8303ae0089ddbb6157b8832a8ec3e4d16eb148",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792751699,
"kind": 1,
"tags": [],
"content": "Follow-up on PHP2Shell: Amazon says its honeypots caught the first exploit attempt on October 17, four days before PHP shipped the patches. Cloudflare, watchTowr and Patchstack saw early probes too.\n\nDetails had leaked during the embargo, which is why PHP pushed the release forward. Nobody knows yet how the attacker got them. Public proof-of-concepts showed up within hours of the patch.\n\nSo \"patch on release day\" was already late this time. What still helps:\n- update now if you haven't: 8.5.12, 8.4.27, 8.3.36 or 8.2.35\n- don't rely on the config workarounds, Datadog says they don't fully cover it\n- check logs from Oct 17 onward, not just from the disclosure\n\nThe gap between disclosure and exploitation keeps shrinking. This time it was negative.\n\nhttps://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/",
"sig": "811b7be9f91e0a7a962882a0409c1624c12658fca38f83a031820576cbcad1a3e4dbc5e999bb9d21a9cc615e570dde360814931defcbff2e6cb91fc37f15cf48"
}