Security researchers report evidence that attackers attempt to exploit PHP2Shell vulnerabilities before the flaws are publicly disclosed and before patches are available. Amazon-related threat intelligence is cited by multiple outlets as detecting early activity and associating it with exploitation attempts occurring days ahead of public disclosure.
Several reports say the initial attempts start around October 17, 2026, and that exploitation activity ramps up soon after patches are released. Across coverage, outlets describe the vulnerabilities as being “broadly exploited” in the wild following patch publication, pointing to large-scale activity rather than isolated probes. The details that vary mainly involve how precisely outlets time the first observed attempts relative to disclosure and patching, and which Amazon investigation or threat-intelligence framing they emphasize.
Overall, all sources present the same core narrative: early exploitation attempts are detected ahead of disclosure, and the vulnerabilities subsequently see wider use after fixes are made available.
