First screen, captured 4 days ago.

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

What HN thinks

Everyone saw the exploit first, nobody patched it first, and the fire extinguisher was vibe-coded in C.

PHP team deflected blame
Some argue the Oct 17 probing shows PHP's criticism of Chainguard for breaking embargo was misplaced, and that PHP mishandled a long-known bug.
Retrospective logs, not real exploitation
Others note Amazon likely found these entries later in logs, and 'attempts' may just be scanner noise; no confirmed working exploits appeared pre-disclosure.
Amazon slow to patch its own
Commenters mock AWS for bragging about early detection while Amazon Linux and Lightsail WordPress blueprints lagged on fixes, though some defend regression testing.

Consensus: Most agree 'exploitation attempt' is vague and Amazon's post doesn't clearly show successful compromise before disclosure. A vibe-coded C proxy offered as a fix was widely distrusted.

Recommended in the comments

AWS WAF (service): Suggested as a quick, toggleable mitigation while patches are tested.
CrowdSec (tool): Reported flagging hundreds of PHP2Shell attacker IPs, some before the patch.

Summarised by Claude from the comment thread 3 days ago.

Points: 227
Comments: 98
Best rank: #9
Posted: 2026-10-22 by cubefox
Category: Security

php php2shell zero-day vulnerability-disclosure honeypot aws threat-intelligence

All captures:

Full page

Captured 4 days ago. Click for the whole screenshot.

Looks similar

Screenshot of jepsen.io: Jepsen: Amazon RDS for PostgreSQL 17.4

Jepsen: Amazon RDS for PostgreSQL 17.4 (jepsen.io)

581 points by aphyr 1 year ago | 138 comments

Jepsen analysis by Kyle Kingsbury showing Amazon RDS for PostgreSQL multi-AZ clusters violate Snapshot Isolation, exhibiting Long Fork anomalies across versions 13.15 to 17.4.

postgresql amazon-rds jepsen snapshot-isolation

Screenshot of promptarmor.com: GitHub Copilot CLI downloads and executes malware

GitHub Copilot CLI downloads and executes malware (promptarmor.com)

43 points by sarelta 8 months ago | 12 comments

Screenshot of gpuhammer.com: GPUHammer: Rowhammer attacks on GPU memories are practical

GPUHammer: Rowhammer attacks on GPU memories are practical (gpuhammer.com)

260 points by jonbaer 1 year ago | 89 comments

Screenshot of aws.amazon.com: Amazon's exabyte-scale migration from Apache Spark to Ray on EC2

Amazon's exabyte-scale migration from Apache Spark to Ray on EC2 (aws.amazon.com)

277 points by nojito 2 years ago | 82 comments

Screenshot of aws.amazon.com: Why AWS Supports Valkey

Why AWS Supports Valkey (aws.amazon.com)

80 points by alexbilbie 2 years ago | 79 comments

Screenshot of safedep.io: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor (safedep.io)

582 points by abhisek 5 days ago | 192 comments

SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.

supply-chain-attack litellm pypi python