Amazon Threat Intelligence has reported that exploitation attempts against the PHP2Shell vulnerabilities began as early as 17 October, four days before the public disclosure and the release of official patches.
The activity was first identified in telemetry from the MadPot network of honeypots. The initial request originated from a commercial anonymization service, and the source of the attacker’s prior knowledge about the flaws remains unknown.
On the morning of 21 October, Amazon observed additional probing activity involving different payloads and infrastructure, suggesting the participation of multiple threat actors. The success of these early attacks against real-world systems has not been confirmed.
Following the publication of the fixes, new proof-of-concept exploits appeared within hours and were rapidly tested against the company’s sensors. In a separate development, OpenAI disclosed that the Calif research team discovered one of the critical vulnerabilities using GPT-5.6 Sol within the Patch the Planet initiative. Wiz independently identified and reported both issues to PHP developers, who prepared the patches with assistance from researchers and infrastructure companies.
Amazon recommends that organizations examine logs for signs of compromise dating back to at least 17 October. While the patch addresses the vulnerabilities, determining whether any attackers gained access prior to the fix requires separate investigation.
