{"rewrite":{"id":"r_36e54ec690b5d20af5431276","clusterId":"c_42bb792c7a511db95afea7bb","slug":"amazon-caught-php2shell-exploitation-attempts-four-days-before-disclosure","model":"deepseek-v4-1-flash","headline":"Amazon Caught PHP2Shell Exploitation Attempts Four Days Before Disclosure","summary":"Amazon Threat Intelligence detected attacks trying to exploit the PHP flaw PHP2Shell four days before public disclosure, according to an AWS security blog. The honeypot system MadPot logged activity from anonymized IP infrastructure on October 17. Multiple proof-of-concept codes appeared around 11:00 on October 21, and further attacks hit MadPot between 11:00 and 17:00. Amazon says different attack code and infrastructure suggest multiple attackers.","whyItMatters":"Attack traffic against a decoy system predates the official patch window, so the leak-driven early disclosure did not start the exploitation clock.","webCardHtml":"\u003cp\u003eAmazon\u0026#39;s honeypot, MadPot, was already receiving PHP2Shell exploit attempts on October 17, while the details were still under embargo. The vulnerabilities carry a severity rating of 9.2, and the emergency PHP update went out at 23:00 on October 21, moved up because related information leaked online before the patch.\u003c/p\u003e\u003cp\u003eAfter that deadline passed, PoC code had been seen around 11:00 the same day, and more attacks landed on MadPot between 11:00 and 17:00. The differing attack code and anonymization infrastructure lead Amazon to read the activity as more than one attacker, though it does not say whether they found the flaw themselves or obtained details through some route.\u003c/p\u003e","blueskyPost":"Amazon's MadPot honeypot logged PHP2Shell activity on October 17, before any public warning existed. The varied attack code points to separate actors, so patching fast is the only defense.","twitterPost":"Amazon's MadPot honeypot saw PHP2Shell probes on October 17. Different code and infrastructure suggest multiple attackers, not one.","threadsPost":"Amazon's MadPot honeypot logged PHP2Shell activity four days before anyone published a warning, and the different code and infrastructure suggest separate attackers were already testing it. That spread narrows the window between a patch and exploitation.","newsletterBlurb":"Amazon Threat Intelligence says its MadPot honeypot recorded PHP2Shell exploitation attempts on October 17, four days before the vulnerability was publicly disclosed. PoC code and further attacks came on October 21, and Amazon reads the differing infrastructure as multiple attackers. The company calls for prompt updates and a check of past attack histories.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261023-amazon-knew-php2shell/\",\"title\":\"Amazon Detected Attacks Exploiting PHP2Shell Vulnerability Four Days Before Public Disclosure\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4563,"outputTokens":578,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1792732030,"createdAt":"2026-10-23T05:02:25.000Z","publishedAt":"2026-10-23T05:06:07.000Z","updatedAt":"2026-10-23T05:06:07.000Z"},"cluster":{"id":"c_42bb792c7a511db95afea7bb","canonicalTitle":"AmazonはPHP2Shell脆弱性を悪用した攻撃を公開4日前に検出していた","representativeArticleId":"a_d33a51f28b9a9930b52b8aaf","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-23T02:51:00.000Z","lastSeenAt":"2026-10-23T02:51:00.000Z","updatedAt":"2026-10-23T05:06:06.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261023-amazon-knew-php2shell/","title":"AmazonはPHP2Shell脆弱性を悪用した攻撃を公開4日前に検出していた"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null}