New threat-intelligence findings from Amazon Web Services show that PHP2Shell was targeted before the public release of fixes for two critical PHP vulnerabilities on October 21, 2026. AWS found the earliest recorded attempt in honeypot logs from October 17. The source IP was linked to a commercial anonymization network, such as a proxy or VPN.

AWS chief information security officer CJ Moses said the timing and anonymized source point to activity by a threat actor. How that actor obtained exploit information before disclosure remains unknown. AWS recorded more attempts in the hours before the October 21 disclosure at 10 a.m. ET. They came through several anonymization providers and appeared to pursue different goals, suggesting multiple actors. Public proof-of-concept exploits appeared on the same day, in some cases hours before the announcement.

AWS has not determined whether the observed attempts would succeed against real-world systems. The company says PHP2Shell is now broadly exploited across the internet. Administrators and security teams rushed to apply the fixes, and some governments and other organizations took key websites offline in anticipation of attacks before patching. The PHP Foundation had not immediately responded to WIRED's request for comment.

CJ Moses said the incident shows that coordinated vulnerability disclosure needs to become faster. AWS argues that AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. The time between disclosure and exploitation can therefore fall from days to hours or minutes. Earlier attacks more often followed a public proof of concept and depended on a small group of capable actors.