Attackers began exploiting critical PHP bugs days before patches shipped

Attackers began targeting two critical vulnerabilities in PHP, the widely used web scripting language, several days before fixes were made public, according to research published Wednesday evening by Amazon Web Services.

PHP released patches Wednesday for the flaws, which researchers have collectively named PHP2Shell. The release triggered a scramble among administrators and security teams to identify and patch affected websites and apps. Some governments and other groups took key websites offline ahead of time so they would not be exposed before patches could be applied.

AWS said its analysts found evidence of exploitation attempts dated October 17, four days before the public disclosure, while reviewing activity on one of its honeypots, a deliberately vulnerable server set up to study attacker behavior. The attempt came from an IP address AWS linked to a “commercial anonymization network,” a type of proxy or VPN service used to mask a user’s location.

“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” CJ Moses, AWS’s chief information security officer, wrote in the research post.

Proof-of-concept exploits, sample code demonstrating how to trigger a flaw, began appearing publicly on Wednesday, with some posted hours before the official 10 am ET disclosure. In the hours leading up to that announcement, AWS said its honeypots registered multiple exploitation attempts from different anonymizing services, pointing to more than one actor at work. Moses said it remains unclear whether any of the attempts would have worked against real systems, but he added that “PHP2Shell is now being broadly exploited in the wild.” The PHP Foundation, the nonprofit that maintains the language, did not respond to a request for comment from Wired.

Faster than before

AWS said the episode shows that coordinated disclosure of vulnerabilities, the practice of privately notifying vendors before going public, needs to move faster given how widely available AI analysis tools have become. Moses wrote that the time between a patch’s release and a working exploit is “shrinking for structural reasons.” In the past, he said, most exploitation followed the release of a public proof of concept, built by a small number of technically skilled actors that everyone else waited on. That dependency, he wrote, is weakening because AI-assisted analysis makes it cheaper to turn a patch diff or security advisory into working attack code.

What remains unverified is how the October 17 actor obtained exploit details before the embargo lifted. AWS has not identified the actor or said whether the early activity connects to the broader wave of exploitation seen this week. Administrators who have not yet patched PHP2Shell should treat the flaws as already under active attack.