Amazon had detected the attack exploiting the PHP2Shell vulnerability four days prior to its public disclosure.

Amazon's threat intelligence team, Amazon Threat Intelligence, announced that it detected attacks attempting to exploit the PHP vulnerability ' PHP2Shell ' four days before the vulnerability was publicly disclosed. Since the information was made public, attacks have been widely confirmed, and Amazon is urging users to promptly update their security and investigate past attack history.

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AWS Security Blog
https://aws.amazon.com/jp/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

Two vulnerabilities were discovered in PHP, a programming language widely used for developing dynamic websites and web applications, and an emergency security update was released on October 21, 2026. Originally, the developer and the discoverer of the vulnerabilities were supposed to cooperate and keep the details confidential, but related information was leaked online before the patch was released, resulting in the update being released earlier than planned.

Two PHP vulnerabilities with a severity rating of '9.2' have been discovered, raising concerns about server hijacking. An emergency patch will be released on October 21st - GIGAZINE

The emergency update was released at 11 PM on the 21st, but because information about the vulnerability had already been made public, the security risk was extremely high, and many websites were scrambling to respond throughout the night.

Various websites and apps, including Niconico and pixiv, are undergoing maintenance to support an emergency PHP patch - GIGAZINE

Meanwhile, Amazon investigated records collected by its honeypot system 'MadPot' and found that attempts to exploit the vulnerability were already being made as early as October 17th, four days before the release of PHP2Shell, and had taken countermeasures. A honeypot is a decoy system intentionally set up to lure attackers, and by actually being attacked, it is possible to investigate the actions and methods used by attackers.

The attack observed on October 17 originated from an IP address associated with a commercial anonymized network. At the time, information regarding the PHP2Shell vulnerability was still under a confidentiality period before public disclosure, leading Amazon to believe it was carried out by a malicious attacker. However, the report does not clarify whether the attacker discovered the vulnerability independently or obtained the information through some other channel.

The confidentiality period for the disclosure of PHP2Shell information was scheduled to end at 11 PM on October 21st (Japan time). However, Amazon's investigation revealed that multiple proof-of-concept (PoC) code had already been identified around 11 AM on the same day (Japan time). Furthermore, additional attacks against MadPot were detected between 11 AM and 5 PM on October 21st. These attacks were also carried out from an anonymized infrastructure, but because there were differences in the attack code used and the infrastructure used for anonymization, Amazon analyzes that it is possible that multiple attackers, not a single one, were involved.

In other words, even before the PHP2Shell vulnerability information was officially released, it's possible that at least multiple attack methods were being used and different attackers were targeting the vulnerability.

The situation changed dramatically when the confidentiality period ended at 11 PM on October 21st and the vulnerability information and patch were made public. Within hours of the release, additional proof-of-concepts (PoCs) emerged, and attacks using these vulnerabilities were reportedly confirmed almost immediately against Amazon's sensors. Amazon has warned that PHP2Shell is already being widely exploited in the real internet environment.

Amazon has pointed out that this incident necessitates a re-evaluation of traditional understandings regarding vulnerability disclosure and the timing of attacks.

Typically, when a software vulnerability is discovered, it is reported confidentially to the developer or other relevant parties, and a period is provided for them to prepare a patch. This is done to reduce the risk of attackers exploiting the information before the patch is completed, by keeping the details of the vulnerability secret for a certain period.

However, such secrecy does not completely prevent attacks, as a third party unrelated to the developers or security researchers may independently discover the same vulnerability. Amazon states that the PHP2Shell case illustrates the danger of considering the day the vulnerability was publicly disclosed as the 'day the attack began.'

Another problem Amazon has cited is the decreasing time between the release of a patch and the start of actual attacks.

Traditionally, a small number of highly skilled attackers would create exploit code, and other attackers would wait for it to be made public. As a result, most vulnerability attacks occurred after the proof-of-concept (PoC) was made publicly available.

However, in recent years, AI-powered analysis has reduced the burden of creating working attack code from information about changes in patches and vulnerabilities. As a result, not only a select few attackers with advanced expertise, but many more attackers are now able to launch attacks within hours, and sometimes even minutes, of vulnerability information being released.

In light of these changes, Amazon is urging security personnel at companies and organizations to think in terms of 'hours' rather than 'days' when a critical vulnerability is discovered in a system exposed to the internet and need to be addressed.

Furthermore, when investigating whether a breach has occurred, it is important to go back to the date the attack was first observed, rather than the date the vulnerability was publicly disclosed. In the case of PHP2Shell, Amazon recommends checking records from at least October 17th onwards.