Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Amazon Threat Intelligence detected PHP2Shell exploitation attempts on October 17, 2026, four days before the public disclosure of the vulnerability, suggesting threat actors had advance knowledge of the exploit. Following the embargo lift on October 21, proof-of-concept exploits proliferated within hours and were immediately used in attacks, demonstrating that the window between patch release and widespread exploitation has dramatically narrowed. Amazon recommends organizations patch immediately, investigate from the earliest exploitation date rather than disclosure date, and develop detection methods beyond CVE-specific signatures, as AI-assisted analysis is enabling more actors to exploit vulnerabilities rapidly.