PHP2Shell Attacks Began Before Public Disclosure of Critical PHP Vulnerabilities

The internet is crazy. A rush to fix two critical vulnerabilities in the widely used PHP web scripting language was already too late to stop all attacks, newly released details reveal.

Attackers Exploited PHP Flaws Before the Public Release

When fixes for the two critical PHP vulnerabilities were released Wednesday, administrators and security teams raced to identify and patch vulnerable websites and applications. Attackers, meanwhile, began reverse-engineering the fixes to determine how to exploit the flaws. Some governments and other organizations proactively took key websites offline in anticipation of the release, helping prevent attacks before patches could be applied.

However, active exploitation was detected before Wednesday’s disclosure. Documents published by Amazon Web Services on Wednesday night show that at least one attacker attempted to exploit the bugs—collectively known as PHP2Shell—on October 17, four days before their public disclosure.

AWS Honeypot Detected an Early Exploit Attempt

AWS analysts discovered the October 17 exploit Wednesday while reviewing activity in one of the company’s honeypots. These intentionally vulnerable web servers and other digital lures help security researchers study attack methods and emerging trends.

The attempt originated from an IP address linked to a “commercial anonymization network,” such as a proxy network or VPN, according to AWS.

“Although this vulnerability was under embargo, the targeting of honeypots from anonymized IP addresses suggests that the activity was carried out by a threat actor, although it remains unclear how the actor obtained the exploit information prior to publication,” AWS Chief Information Security Officer CJ Moses said in an investigative post.

Multiple Attackers Targeted PHP2Shell

Proof-of-concept exploits for PHP2Shell began appearing Wednesday, with some emerging hours before the public release at 10 a.m. ET. AWS researchers said their honeypots were hit by multiple anonymized exploitation attempts in the hours leading up to the disclosure.

The attempts used different providers, appeared to target different systems and were likely carried out by multiple attackers. “While technical analysis is ongoing, it is unclear whether these efforts will be successful in real-world systems,” Moses wrote. He added that PHP2Shell is now being widely exploited.

The PHP Foundation did not immediately respond to WIRED’s request for comment.

AI Is Accelerating Vulnerability Exploitation

It remains unclear how the October 17 exploit was created or where it came from. AWS said the findings demonstrate the need for coordinated vulnerability disclosure to evolve and move faster, particularly as global access to AI tools accelerates vulnerability analysis and allows less technically proficient attackers to develop new exploits quickly.

“For structural reasons, the time between a patch being applied and an exploit becoming effective is decreasing,” Moses wrote. “Historically, most of the exploits we observed took place after a proof of concept was published. A few talented attackers built an exploit and everyone else waited. That dependency is weakening.”

“AI-assisted analytics makes it cheaper to turn patch deltas and advisories into working exploits, allowing more attackers to act within hours or even minutes of the technical details of a vulnerability being made public.”