AWS honeypot data shows PHP vulnerability was exploited days before the patch was released

AWS honeypot data shows that 4 days before the patch was released (October 17), attackers had already attempted to exploit two critical PHP vulnerabilities (collectively called PHP2Shell). The patch was released on Wednesday, and some proof-of-concept exploit code had already appeared publicly before disclosure; AWS says PHP2Shell has been widely exploited in the wild. AWS notes that AI-assisted analysis is shortening the time from patch to exploit code, and more attackers are able to act within hours or even minutes after disclosure.