AWS says MadPot saw PHP2Shell exploit attempt before public disclosure
Amazon Linux 2023 release notes published four days later listed updated PHP packages.
By Morgan Laning · Published · Updated
Why it matters
AWS’s report puts an exploit attempt before public disclosure, while the later package records show updated PHP versions were available in Amazon Linux 2023 sooner than the bulletin’s target date indicated.
AWS said its MadPot honeypots observed a PHP2Shell exploit attempt on Oct. 17th, four days before the vulnerability was publicly disclosed. The report describes an attempt, not evidence that a system was successfully compromised.
An attempt is not the same as a working exploit. The PHP Foundation's postmortem said there were no functional exploits at release, and RuntimeWire has asked AWS what the Oct. 17th attempt targeted.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.