Amazon says an exploit attempt hit its honeypot days before PHP2Shell flaws went public

Past-week coverage · Original source published 2026-10-22.

Amazon's Threat Intelligence team said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service. The company disclosed the finding on Wednesday, and The Hacker News reported it on October 22, 2026, four days after the attempt.

According to the report, the exploit attempt originated from an IP address associated with a commercial anonymization network. The article attributes that detail to CJ Moses of Amazon. It does not say which PHP2Shell flaw was targeted, what the payload did, or whether the attempt succeeded.

The timing is the notable part. The attempt came before the vulnerabilities were publicly disclosed, which suggests whoever sent it had some advance knowledge of the flaws or was probing broadly enough to stumble onto them. The source does not establish which.

The report also says the flaws are now under broad exploitation in the wild following the release of patches. That is a general characterization, not a count of victims or campaigns.

For defenders, the practical takeaway is to treat PHP2Shell exposure as urgent rather than theoretical. The source points to patches being available, so identifying internet-facing PHP components in scope and applying the vendor fixes is the obvious first step. Because the source gives no affected version ranges or severity scores, teams should confirm scope against the vendor advisories rather than assume. Watching for traffic from anonymizing networks is a reasonable detection signal, though it is weak on its own.