Hackers Exploited PHP Vulnerabilities Before Public Patch
Amazon Web Services says it detected attempts to exploit PHP2Shell on October 17, four days before public disclosure of two critical PHP vulnerabilities. The…
Amazon Web Services says an attacker tried to exploit PHP2Shell before the flaws were publicly disclosed, exposing a gap between private vulnerability handling and real-world attacks. The attempt came on October 17, four days before details and fixes for two critical PHP vulnerabilities were released.
AWS researchers found the activity while reviewing records from a deliberately vulnerable server, known as a honeypot. The evidence does not establish whether the attempt would have worked against a real system, but it shows that an actor was testing the vulnerabilities before the public release.
The timing matters for organizations that run PHP-powered websites and services: patching after public disclosure may not be early enough to prevent every attempt.
AWS found an earlier attempt
The October 17 request came from an IP address that AWS linked to a “commercial anonymization network,” which can include proxy services or virtual private networks. AWS said it remains unclear how the actor obtained exploit information before disclosure.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” CJ Moses, AWS’s chief information security officer, wrote in the company’s research post.
Researchers also recorded multiple attempts against honeypots in the hours before the public disclosure at 10 am ET on Wednesday. The attempts used different anonymization providers and appeared to have different goals, AWS said, suggesting more than one actor may have been involved.
That does not confirm successful breaches. “Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems,” Moses wrote. He added that “PHP2Shell is now being broadly exploited in the wild.”
Patch window narrows
PHP developers released fixes on Wednesday for two critical vulnerabilities. The disclosure triggered a rush among administrators to identify affected sites and install updates. Some governments and organizations took websites offline temporarily while they prepared to patch them.
Separate reporting by DW said the PHP team urged users to update immediately. The vulnerabilities could allow attackers to take control of websites and servers remotely, and could expose government databases or customer information, according to that report.
For organizations that cannot apply a fix at once, taking an exposed service offline can reduce its availability to attackers, but it also interrupts public access. The immediate choice is practical: patch quickly, or keep the system out of reach until it can be secured.
AWS said proof-of-concept exploits began appearing publicly on Wednesday, with some posted hours before disclosure. Researchers warned that artificial intelligence tools could help more people analyze technical advisories or software changes and turn them into working exploits.
“The time from patch to working exploit is shrinking for structural reasons,” Moses wrote. He said AI-assisted analysis could make exploit development cheaper and allow actors to move within hours or minutes after technical details become public.
The October 17 attempt preceded the public disclosure by four days.
Source: wired.com
