AWS analysts claim that at least one actor started to exploit the PHP2Shell bugs on October 17, four days prior to the vulnerabilities' public disclosure (Lily Hay Newman/Wired)

AWS says it observed exploitation attempts against the PHP2Shell vulnerabilities four days before public disclosure, and the bugs are now being broadly weaponized across the internet. For CIOs and technology leaders, this is a reminder that zero-day exposure windows can begin before advisories are published, making rapid detection, patch acceleration, and external attack-surface monitoring critical to limiting business disruption, data exposure, and ransomware footholds. IT organizations should treat internet-facing PHP environments as immediate risk items and assume active exploitation is already underway.