"PHP 취약점 공개 나흘 전부터 공격 포착…악용 시도 수백만건" - 경제 | 기사 - 더팩트

"PHP 취약점 공개 나흘 전부터 공격 포착…악용 시도 수백만건" - 경제 | 기사 - 더팩트

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page kr/news/news-tf/read-economy-2380063-htm, snapshot 20261027T071509Z. Copied byte for byte; every file's sha256 is in captures/20261027T071509Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

The Fact (Korea, Korean), 23 October, by Lee Yoon-kyung: attacks spotted four days before the PHP flaws were disclosed, with attempts in the millions after. It relays Amazon's CISO CJ Moses's blog post that the 17 October attempt was caught in MadPot from an IP linked to a commercial anonymisation network, that Amazon saw several attackers on disclosure day, that it has not established how the attacker had the flaw information beforehand or whether any attack succeeded on a production server, and Cloudflare's figures (thousands in the ten hours before, tens of thousands in 45 minutes, hundreds of thousands in two hours, then millions). It adds Korea's MSIT/KISA move to 'Caution' on 22 October at noon and the advice to check logs for web shells after patching. Corroborates figures already held.

> 아마존은 공격자가 취약점 정보를 사전에 확보한 경위와 실제 운영 서버에서 공격이 성공했는지는 확인되지 않았으며, 관련 기술 분석을 진행 중이다.

_Curator's translation:_ "Amazon says it has not established how the attacker obtained the vulnerability information beforehand or whether the attack succeeded on a real production server, and its technical analysis is under way."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: ""PHP 취약점 공개 나흘 전부터 공격 포착…악용 시도 수백만건" - 경제 | 기사 - 더팩트". Selected mechanically, not read by a person.

Capture notes

Language ko. Nothing in the page addresses an AI or hides text from a reader.