AWS Finds PHP2Shell Exploitation Began Days Before Patches Were Released

Attackers were already trying to exploit two critical PHP vulnerabilities before fixes became public, according to new research from Amazon Web Services.

The flaws, collectively known as PHP2Shell, prompted a rush on Wednesday as administrators and security teams raced to patch vulnerable websites and apps. Some governments and other groups took key sites offline ahead of the release to avoid being targeted before patches could be applied.

But AWS, reviewing activity on one of its honeypots-an intentionally vulnerable server used to study attack methods-found an exploitation attempt on October 17, four days before the public disclosure. The attempt came from an IP address AWS links to a commercial anonymization network, such as a proxy or VPN.

Proof-of-concept exploits began appearing publicly on Wednesday, some seemingly hours before the 10 am ET disclosure. AWS said its honeypots were hit with multiple attempts using various anonymization providers and apparently different goals, likely pointing to several actors.

CJ Moses, AWS's chief information security officer, wrote that it remains unclear how the actor obtained exploit information before disclosure, and that technical analysis is ongoing. He added that PHP2Shell is now being broadly exploited in the wild.

AWS said the findings highlight the need for coordinated vulnerability disclosure to evolve and speed up, citing AI tools that make it cheaper to turn a patch or advisory into a working exploit. "The time from patch to working exploit is shrinking for structural reasons," Moses wrote.

The PHP Foundation did not immediately respond to a request for comment.

Source: Wired