Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot

Initial PHP2Shell exploitation was observed four days before patches landed, and many servers run outdated PHP versions.