Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed

Amazon's Threat Intelligence team detected an attempt to exploit PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service. This exploit attempt occurred four days before the vulnerabilities were publicly disclosed. The attempt originated from an IP address linked to a commercial anonymization network. The flaws are now being broadly exploited in the wild, following the release of patches.