Hackers Exploited PHP Vulnerabilities Days Before Patches Were Released

Early Exploitation Detected

AWS researchers discovered that at least one threat actor began targeting a honeypot with exploits for two critical PHP vulnerabilities on October 17, four days before the public patch release. The activity originated from an IP address linked to a commercial anonymization network, indicating deliberate concealment.

Patch Release and Immediate Response

On Wednesday the PHP project issued fixes for the flaws, collectively named PHP2Shell. Administrators raced to apply updates while proof-of-concept exploits appeared publicly, some surfacing hours before the official 10 am ET disclosure. AWS honeypots recorded multiple exploitation attempts from various anonymized providers, suggesting several independent actors were probing the vulnerabilities.

AI Accelerates Exploit Development

AWS chief information security officer CJ Moses warned that the window between patch availability and functional exploit code is shrinking. AI-assisted analysis lowers the cost of turning a patch diff into a working exploit, enabling a broader range of actors to act within hours or minutes of disclosure. The findings underscore the need for faster coordinated vulnerability disclosure processes.

Earlier coverage: PHP2Shell patches are out: what is at risk and how to protect PHP sites · EU and Canadian Government Sites Taken Offline After PHP Vulnerability Disclosure

Sources: Wired · The Register · PHP Foundation