Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Our take – ONQU

Attacks on the PHP2Shell flaw are now running at scale, and AWS says some attackers started probing four days before patches were released, so UK organisations running PHP-based systems should assume exposure until they have confirmed patching. Cloudflare reports millions of exploit attempts, which means the window between disclosure and mass exploitation is closing fast. For IT leaders and database teams, the practical lesson is that patch timing is a data security issue, not just an infrastructure task. We would check every web-facing PHP estate, including any supporting database connections, and review logs from the period before the public patch date for signs of unusual activity. Where systems hold patient or financial records, a delay of days can turn into a serious incident and a costly outage. Our managed services team helps organisations keep critical data systems patched and monitored around the clock, so that vulnerabilities are caught and contained quickly. If your team is unsure whether a dependent database or cloud environment has been touched, a short review of your data security posture is a sensible first step.