Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
wired ·
Hackers exploited critical PHP vulnerabilities known as PHP2Shell four days before the official patch release, according to new details from Amazon Web Services. AWS researchers discovered these early attempts on October 17 by analyzing traffic on their honeypot servers, noting that the attacks originated from an IP address linked to a commercial anonymization network. Although the public disclosure occurred on Wednesday, some actors had already reverse-engineered fixes or accessed exploit information prior to the embargo lifting. Proof-of-concept exploits began appearing online shortly before the 10 am ET announcement, with multiple distinct actors targeting systems using various anonymized providers. AWS Chief Information Security Officer CJ Moses confirmed that PHP2Shell is now being broadly exploited in the wild across the internet. The incident highlights how AI-assisted analysis is significantly reducing the time between patch availability and functional exploit development. This shrinking window suggests that coordinated vulnerability disclosure processes must evolve to keep pace with faster, more accessible attack tools. Consequently, less technically proficient actors can now develop working exploits within hours or minutes of technical details becoming available.
wired