The scramble to patch two critical vulnerabilities in PHP, the widely used web scripting language, began too late to head off every attack, according to newly released research. Amazon Web Services (AWS) says at least one actor began trying to exploit the flaws, known collectively as PHP2Shell, on October 17, four days before the public disclosure on Wednesday, October 21.
The release of fixes that day sent administrators and security teams racing to find and update vulnerable websites and applications. Attackers, meanwhile, were expected to study the fixes in order to work out how to exploit the bugs. Some governments and other organizations went further, taking key websites offline ahead of the release so they could not be targeted before patches were applied.
AWS published its findings on Wednesday evening. Its analysts identified the October 17 activity while reviewing past traffic to one of their honeypots, which are intentionally vulnerable servers or other digital lures that researchers use to study attack methods and trends. The attempt came from an IP address AWS links to a "commercial anonymization network," meaning a proxy network or VPN.
CJ Moses, AWS's chief information security officer, wrote in the research post that because the vulnerability was under embargo at the time, the use of an anonymized address to hit a honeypot suggests the work of a threat actor. He added that "it remains unclear how the actor acquired exploit information prior to disclosure."
Proof-of-concept exploits for PHP2Shell began appearing publicly on Wednesday, and some seemed to surface hours before the disclosure at 10 am ET. AWS researchers say their honeypots were hit with multiple exploitation attempts in the hours leading up to the announcement. The attempts were masked through various providers and appeared to pursue different goals, which likely points to several separate actors. Moses cautioned that technical analysis is continuing and that it is unclear whether any of the attempts would have worked against real-world systems. He also wrote that PHP2Shell "is now being broadly exploited in the wild."
Elizabeth Barron, executive director of the PHP Foundation, told WIRED the organization was not aware of the AWS research before it was published and had no immediate comment on the findings. She later added: "Although we agree that upgrading is absolutely imperative, to our knowledge, there has been no successful attempt at remote code execution."
AWS said the episode shows that coordinated vulnerability disclosure needs to evolve and move faster, given global access to AI tools that speed up vulnerability analysis and let less technically skilled actors develop exploits quickly.
"The time from patch to working exploit is shrinking for structural reasons," Moses wrote. In the past, he explained, most exploitation AWS observed followed the release of a public proof of concept, with a small number of capable actors building exploits while everyone else waited. "That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."
