https://reddit.com/r/cybersecurity/comments/1xdg7av/amazon_threat_intelligence_identifies_php2shell/: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services

Q: When did exploitation attempts begin, and how widespread are they?

Amazon Threat Intelligence observed attempted exploitation as early as October 17, before the October 21 public disclosure. It also observed widespread exploitation attempts after disclosure, although researchers have not established that every attempt successfully compromised a server.

Q: Are services hidden behind Tor protected from these vulnerabilities?

No. An onion service using vulnerable PHP may still be exposed even if its origin server IP address is hidden, because Tor protects the network path rather than the application itself.

Q: Which PHP releases should be used to remediate the issue?

Upgrade to the applicable patched PHP release: 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

Q: What should teams do if they suspect prior exposure?

Review server logs going back to at least October 17 for attempted exploitation. Web application firewalls may reduce exposure, but they are not a substitute for patching.

Published Oct 23, 2026

Updated

Affected Software

1 affected component

PHP PHP<8.2.35, <8.3.36, <8.4.27, <8.5.12

Frequently Asked Questions

When did exploitation attempts begin, and how widespread are they?

Amazon Threat Intelligence observed attempted exploitation as early as October 17, before the October 21 public disclosure. It also observed widespread exploitation attempts after disclosure, although researchers have not established that every attempt successfully compromised a server.

Are services hidden behind Tor protected from these vulnerabilities?

No. An onion service using vulnerable PHP may still be exposed even if its origin server IP address is hidden, because Tor protects the network path rather than the application itself.

Which PHP releases should be used to remediate the issue?

Upgrade to the applicable patched PHP release: 8.2.35, 8.3.36, 8.4.27, or 8.5.12.

What should teams do if they suspect prior exposure?

Review server logs going back to at least October 17 for attempted exploitation. Web application firewalls may reduce exposure, but they are not a substitute for patching.