Comment by Tomdarkness
6 hours ago
So Amazon knew about this exploit and that it was actively being used several days before the release of any patches. Despite this they still took 18 hours AFTER the release of the patches to provide updated version of their Amazon Linux packages?
https://github.com/amazonlinux/amazon-linux-2023/issues/1148
I don't think this blog post is sending the message AWS intended...
What makes you think they knew about it on the 17th? Scanning old logs is not the same as understanding them as they're generated.
If this is only a retrospective find then they should make it more clear, from the blog it reads to me as promoting their MadPot tool for detection pre CVE disclosure:
"Subsequently, from 2026-10-21 0200 UTC to 2026-10-21 0800 UTC, Amazon Threat Intelligence identified additional exploitation attempts of PHP2Shell targeting MadPot from additional anonymized infrastructure." (i.e almost 12 hours before the release of the patch)
"Invest in detections that don’t rely on a signature for a specific CVE. The first exploitation will often come before those signatures exist."
"We analyze over 200 billion events per minute and integrate threat intelligence from our MadPot honeypot network to identify and block known exploitation attempts in real time. Our honeypot system provides us with early detection of exploitation attempts, enabling rapid response and threat analysis."
My reading here is that they've gone through their logs retrospectively, because you can see these attempts to exploit pretty clearly in an observability platform, and the 17th is only five days ago, so you can assume they've got a lot of fully detailed logs over that period.