Attackers Exploited PHP2Shell Four Days Before Anyone Knew It Existed

PHP2Shell, LiteLLM, GitLab: Find What You Need to Patch

Between October 16 and 23, 2026, PHP, Node.js, GitLab, LiteLLM, OpenCode, and the eMudhra certificate authority all suffered serious security incidents, and Amazon's MadPot honeypots caught a PHP2Shell exploit attempt four days before disclosure. Patching is the easy part; the real work is figuring out where the affected software runs, who owns it, and what it can reach. The piece walks through read-only AWS and Azure commands to answer those questions for each incident.