AWS says hackers tried to exploit PHP security issues days before fix — as Cloudflare CEO says it saw a huge rise…
- Evidence suggests PHP2Shell exploitation began days before public disclosure, indicating prior attacker knowledge
- Researchers say real-world attacks remain limited, though exploitation attempts rapidly surged after disclosure
- Millions of PHP systems remain exposed, with experts urging immediate patching of supported versions
The exploitation of php2shell began four days before the vulnerabilities were made public, Amazon has claimed, meaning someone knew well in advance about the bugs in the popular software.
The company has released its own analysis which shows that the attacks actually started several days earlier.
“Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619,” the company said in an advisory. “The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
