# Source: Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Notimérica: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche

**Notimérica** · [https://www.notimerica.com/ciencia-tecnologia/noticia-portaltic-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105527.html](https://www.notimerica.com/ciencia-tecnologia/noticia-portaltic-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105527.html) · published 2026-10-23T10:55:27+02:00 · added by `curator@php.newsroom` · slug `notimerica-ciencia-tecnologia-noticia-portaltic-ama`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261024T083755Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Notimérica (Spanish), 23 October, a Portaltic (Europa Press) item on Amazon Threat Intelligence's report. Amazon identified an exploitation attempt on...

## What it says, as the collector read it

#### Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `mx/news/notimerica/ciencia-tecnologia-noticia-portaltic-amazon-detecto-intentos`, snapshot `20261024T083755Z`. Copied byte for byte; every file's sha256 is in `captures/20261024T083755Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Notimérica (Spanish), 23 October, a Portaltic (Europa Press) item on Amazon Threat Intelligence's report. Amazon identified an exploitation attempt on 17 October, caught in its MadPot honeypot telemetry and coming from an IP address on a commercial anonymising network; on disclosure day it also saw several proof-of-concept exploits and further attempts from other anonymised infrastructure, with payloads and infrastructure varying, which it says suggests multiple actors. The piece adds that Cloudflare reported early attacks, that the EU's emergency response team advised isolating internet-facing applications that cannot be updated at once, and that the Netherlands, Belgium and France confirmed voluntary suspensions of official services while Japan recommended disabling pages in extreme cases. It corroborates the 17 October date held in cur2-madpot-17-oct.

> En concreto, el equipo de Amazon Threat Intelligence identificó un intento de explotación el 17 de octubre.

_Curator's translation:_ "Specifically, the Amazon Threat Intelligence team identified an exploitation attempt on 17 October."

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Portaltic.-Amazon detectó intentos de explotación de PHP2Shell días antes de que se divulgaran las vulnerabilidades y su parche". Selected mechanically, not read by a person.

#### Capture notes

Language `es`. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261024T083755Z · HTTP 200 · https://www.notimerica.com/ciencia-tecnologia/noticia-portaltic-amazon-detecto-intentos-explotacion-php2shell-dias-antes-divulgaran-vulnerabilidades-parche-20261023105527.html- `headers.json` 4d87a5d7012173d3a0a14574839c0c0870961edc1ac5c3d3f9719aef0ed51498 787 bytes
- `page.html` ef688027f5bd149a3893bedbb4cb0d67f5ecd13b0efc4d5d1b905ed3099a1d13 256,794 bytes
- `provenance.json` c725dc351b21f0d0249c2b928765f343475391709a5908e1c8cf32b21ea737d8 2,000 bytes
- `rendered.html` acb522f90cf22cda42821308f578068b804c4a64bbc4c9e04e49dd184ab67c03 281,320 bytes
- `screenshot.jpg` 95858a7410aa6d568d4ce99801f99007c75ea7674065145b204b5bec42850a20 322,739 bytes
- `text.txt` a2b57b3982d09f3b4ab88f8df56be5a2bf330bc5c8d469970e2b957e567918a1 3,927 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.36 · data as of 2026-10-26T17:09Z · vault commit 1dceaa1dfa7f · https://refs.php.oct.2026.newsroom.sgit.ai/sources/notimerica-ciencia-tecnologia-noticia-portaltic-ama/index.html