Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Source · news · secondary · captured
Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche
Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notimérica (Spanish), 23 October, a Portaltic (Europa Press) item on Amazon Threat Intelligence's report. Amazon identified an exploitation attempt on...
What it says, as the collector read it
Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche
Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page mx/news/notimerica/ciencia-tecnologia-noticia-portaltic-amazon-detecto-intentos, snapshot 20261024T083755Z. Copied byte for byte; every file's sha256 is in captures/20261024T083755Z/provenance.json and was re-checked against the watch's own hashes.
What the page says
_Curator's reading of the capture._
Notimérica (Spanish), 23 October, a Portaltic (Europa Press) item on Amazon Threat Intelligence's report. Amazon identified an exploitation attempt on 17 October, caught in its MadPot honeypot telemetry and coming from an IP address on a commercial anonymising network; on disclosure day it also saw several proof-of-concept exploits and further attempts from other anonymised infrastructure, with payloads and infrastructure varying, which it says suggests multiple actors. The piece adds that Cloudflare reported early attacks, that the EU's emergency response team advised isolating internet-facing applications that cannot be updated at once, and that the Netherlands, Belgium and France confirmed voluntary suspensions of official services while Japan recommended disabling pages in extreme cases. It corroborates the 17 October date held in cur2-madpot-17-oct.
> En concreto, el equipo de Amazon Threat Intelligence identificó un intento de explotación el 17 de octubre.
_Curator's translation:_ "Specifically, the Amazon Threat Intelligence team identified an exploitation attempt on 17 October."
Why it is here
From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche". Selected mechanically, not read by a person.
Capture notes
Language es. Nothing in the page addresses an AI or hides text from a reader.
Claims that cite it
No claim cites this source yet.
Events that cite it
No timeline event cites this source yet.
The bytes
capture 20261024T083755Z · HTTP 200 · https://www.notimerica.com/ciencia-tecnologia/noticia-portaltic-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105527.html
headers.json4d87a5d7012173d3a0a14574839c0c0870961edc1ac5c3d3f9719aef0ed51498 787 bytespage.htmlef688027f5bd149a3893bedbb4cb0d67f5ecd13b0efc4d5d1b905ed3099a1d13 256,794 bytesprovenance.jsonc725dc351b21f0d0249c2b928765f343475391709a5908e1c8cf32b21ea737d8 2,000 bytesrendered.htmlacb522f90cf22cda42821308f578068b804c4a64bbc4c9e04e49dd184ab67c03 281,320 bytesscreenshot.jpg95858a7410aa6d568d4ce99801f99007c75ea7674065145b204b5bec42850a20 322,739 bytestext.txta2b57b3982d09f3b4ab88f8df56be5a2bf330bc5c8d469970e2b957e567918a1 3,927 bytes
The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →