Follow-up to Oct 21: Amazon identifies PHP2Shell attempts before disclosure
Amazon says its honeypots recorded an exploitation attempt on October 17, four days before public disclosure; technical analysis of the attempts is ongoing.
ThereforeAmazon recommends investigating from October 17, rather than starting at the advisory date.