Attackers were already trying to exploit two critical PHP vulnerabilities days before they became public, according to research from Amazon Web Services. The flaws, collectively dubbed PHP2Shell, were disclosed and patched on Wednesday, but AWS said it found an exploitation attempt on October 17 - four days earlier - while reviewing activity on one of its honeypots.

The attempt came from an IP address AWS links to a commercial anonymization network. "While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," wrote AWS chief information security officer CJ Moses.

Proof-of-concept exploits began surfacing publicly on Wednesday, some apparently hours before the 10 am ET disclosure, and AWS said its honeypots logged multiple anonymized attempts with varying goals, likely pointing to several actors. Moses said it is unclear whether any attempt would have worked on real systems, but that PHP2Shell is now being broadly exploited in the wild.

The US National Security Agency and UK authorities warned organizations to update or take systems offline, and some European governments reportedly pulled sites down while patching. The bugs, uncovered with help from OpenAI and Google models after going undetected for more than a decade, were patched by PHP's maintainers on Wednesday.

AWS argued the findings show coordinated disclosure must move faster as AI tools make it cheaper to turn a patch or advisory into a working exploit. "The time from patch to working exploit is shrinking for structural reasons," Moses wrote, noting that more actors can now act within hours or minutes of technical details being released.

Source: Wired