Amazon saw a PHP2Shell exploitation attempt four days before patches

The pre-patch window

SecurityWeek reported on 22 October that Amazon observed a PHP2Shell exploitation attempt on 17 October 2026, while the flaws were still under embargo. The attempt came from a commercial anonymisation network and targeted a honeypot.

Amazon also reported finding multiple proofs of concept from different anonymised infrastructure roughly 12 hours before disclosure. That suggests more than one actor had access to details before the coordinated release. How the first actor obtained pre-disclosure exploit information has not been publicly established.

Why the date matters

The timeline matters for incident response. If an organisation only searches logs from the moment the patch was published, it may miss the earlier window. SecurityWeek’s report gives 17 October as the earliest reported attempt, not as the date every exposure began.

The evidence ladder still applies. An attempt against a honeypot is a real signal that exploit code or probing existed. It is not proof that the target was compromised, and it is not proof that any production site was. A successful exploit may also return HTTP 200 and leave the worker running, so a clean error log is not a clean bill of health. The compromise checks in the remediation guide describe what to look for without treating crash logs as a compromise detector.

What is not established

This site has not found a public, confirmed account of a specific production site being compromised through PHP2Shell as of 22 October 2026 (UTC). That statement is bounded by the sources checked. It is not a claim that no compromise happened.