Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]
Amazon says PHP2Shell exploitation began 4 days before patches
Summary + source link. No paywalls, no tracking.