PHP2Shell exploited 4 days before public disclosure, Amazon honeypot data shows

Thu, 22 Oct 2026 15:52:23 +0000

Engineer — Act: Active in-the-wild exploitation of PHP2Shell predating patch release confirms high urgency — patch PHP2Shell immediately and audit server logs from October 17 onward for exploitation attempts.
SOC/IR — Act: Pre-patch exploitation means assume-breach posture for any environment running PHP2Shell; hunt for anomalous PHP execution or webshell activity since October 17 and watch for traffic from commercial anonymization network IPs.
Leader — Plan: Pre-disclosure exploitation of a PHP vulnerability with broad in-the-wild follow-on is a systemic risk signal worth surfacing to engineering leads; confirm internal PHP2Shell exposure and track remediation status this week.

Php2shell on CuraSec