Útok na PHP2Shell začal už čtyři dny před zveřejněním zranitelností, tvrdí Amazon - Root.cz

Útok na PHP2Shell začal už čtyři dny před zveřejněním zranitelností, tvrdí Amazon - Root.cz

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page cz/news/root/zpravicky-utok-na-php2shell-zacal-uz-ctyri-dny-pred-zverejne, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

Root.cz (Czech), a short news item by Petr Krčmář, probably 22 October. It says Amazon recorded the first exploitation attempt on 17 October, four days before publication, on its MadPot honeypot network, on a server meant to attract attackers and not an ordinary production site, from an IP address linked to a commercial anonymisation network; Amazon cannot explain how the attacker learned of the flaws before disclosure. More attempts from various sources came several hours before publication, which may point to several actors; after the fixes attempts rose, but it is not certain every captured attempt could have succeeded on a truly vulnerable server. Amazon advises administrators to look for signs of attack from at least 17 October, not from disclosure day.

> Amazon doporučuje správcům při hledání známek útoku nezačínat až dnem zveřejnění zranitelností, ale prověřit podezřelou aktivitu nejméně od 17. října.

_Curator's translation:_ "Amazon recommends that administrators looking for signs of attack should not start from the day the vulnerabilities were published but check for suspicious activity from at least 17 October."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Útok na PHP2Shell začal už čtyři dny před zveřejněním zranitelností, tvrdí Amazon - Root.cz". Selected mechanically, not read by a person.

Capture notes

Language cs. The lead image is credited as made with 'Zoner AI' (site chrome). Nothing in the article text addresses an AI or hides text from a reader.