Amazon reports finding evidence of an exploit attempt in logs from Saturday October 17, four days before public disclosure [1].
honest to god the insane 1-to-1 "show us the code!1" responses we keep seeing here make me wonder if the state-level actor is trying their hardest to keep people from patching.
it's painfully clear this is KEV and remotely exploitable on damn near every PHP install -- it's a big deal