PHP2Shell RCE Probes Hit Honeypots Four Days Pre-Patch from Commercial Anonymization Network

Threat actors began probing for the two remote code execution flaws in PHP on October 17 using a commercial anonymization network, according to Amazon telemetry. The activity occurred while the issues remained under embargo, with PoC code leaking on October 20. Multiple vendors recorded unsuccessful attempts from varied infrastructure, indicating at least two distinct actor groups preparing payloads ahead of public disclosure. Censys and VulnCheck data show roughly 1.57 million of 2.58 million internet-facing PHP hosts remained unpatched as of October 21, including over 1 million running end-of-life versions. Cloudflare recorded thousands of attempts in the 10 hours before announcement, scaling to millions within hours afterward. WatchTowr noted that most circulating PoCs either failed or crashed targets, revealing rushed development rather than refined tooling. The pattern matches prior embargo leaks where commercial anonymizers shielded early reconnaissance, complicating attribution. Official statements from CISA emphasize immediate patching, yet the concentration of vulnerable hosts on five major providers suggests configuration management gaps persist despite known exposure. Independent scans confirm the majority reside in the US, increasing the blast radius for any successful webshell deployment. Operational focus now shifts to post-patch verification and WAF rule deployment. Providers can push mitigations centrally, but organizations running EoL PHP must migrate or isolate assets. Continued monitoring of GitHub and VirusTotal for working exploits will determine whether the initial wave evolves into sustained campaigns.