Amazon MadPot Detected PHP2Shell Probe from 103.216.220.92 on October 17, Four Days Pre-Disclosure

The probe targeted memory management and error-handling paths that every PHP request touches, enabling pre-auth remote code execution with no authentication, no session artifacts, and only a routine memory-limit fatal in web server logs. CrowdStrike telemetry confirms worker processes stayed stable and returned HTTP 200, leaving defenders without application-layer signals.

Contract and procurement records show Chainguard received the embargoed patch early to ship fixed container images, creating a binary diff window for any observer. The PHP Foundation's post-embargo statement notes this move collapsed the coordinated timeline by a day and exposed the fix to reverse engineering while most users remained unpatched.

Multiple threat actors appear involved: five additional anonymized IPs hit sensors within six hours of the October 21 release, per Amazon and ELLIO data. The pattern matches prior embargo-leak campaigns where commercial anonymization networks shield early exploit development before mass scanning begins.

International agencies have issued urgent patching guidance; unpatched endpoints remain reachable via any static route or health check, and the absence of telemetry means compromise detection now depends on memory forensics or network egress monitoring.