rich1.0zhashtoshi_ (npub1v7…hvl8a)https://nostr.now/npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8anjumphttps://nostr.nowFollow-up on PHP2Shell: Amazon says its honeypots caught the first exploit attempt on October 17, four days before PHP shipped the patches. Cloudflare, watchTowr and Patchstack saw early probes too. Details had leaked during the embargo, which is why PHP pushed the release forward. Nobody knows yet how the attacker got them. Public proof-of-concepts showed up within hours of the patch. So "patch on release day" was already late this time. What still helps: - update now if you haven't: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 - don't rely on the config workarounds, Datadog says they don't fully cover it - check logs from Oct 17 onward, not just from the disclosure The gap between disclosure and exploitation keeps shrinking. This time it was negative. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/