PHP2Shell exploitation started days before patches
Threat actors began probing servers affected by two critical remote code execution (RCE) vulnerabilities in PHP four days before fixes were released. Amazon reported that PHP2Shell exploitation began on October 17 and became widespread after the patches were released.
CERT24