On Wednesday, the open‑source community rushed to apply patches for two critical PHP flaws, but the effort came after at least one attacker had already begun exploiting the vulnerabilities. Amazon Web Services (AWS) disclosed that activity targeting the bugs, collectively called PHP2Shell, was observed on October 17—four days before the public announcement and patch release.
Timeline of the PHP2Shell exploits
The PHP fixes were released on Wednesday, prompting administrators and security teams to locate and remediate vulnerable sites. At the same time, attackers reverse‑engineered the patches to understand the underlying weaknesses. Some governments and organizations pre‑emptively took down key websites in anticipation of the release, aiming to avoid being hit before patches could be applied.
While reviewing logs from a deliberately vulnerable server—known as a honeypot—AWS analysts identified an exploitation attempt on October 17. The traffic originated from an IP address that AWS linked to a “commercial anonymization network,” indicating the use of a proxy or VPN service. CJ Moses, AWS’s chief information security officer, noted that the activity occurred while the vulnerability was still under embargo, suggesting a threat actor had obtained exploit details before the official disclosure.
Proof‑of‑concept (PoC) exploits for PHP2Shell began appearing publicly on Wednesday, with some surfacing hours before the 10 a.m. ET public disclosure. In the hours leading up to the announcement, AWS’s honeypots received multiple exploitation attempts from anonymized sources using various providers. The diversity of IPs and attack vectors points to several independent actors, though AWS could not confirm whether any of the attempts would have succeeded against live systems.
Implications for coordinated vulnerability disclosure
In its research post, AWS emphasized that the early exploitation underscores the urgency of evolving coordinated vulnerability disclosure processes. The agency highlighted that global access to artificial‑intelligence tools can accelerate vulnerability analysis, enabling less technically proficient actors to develop functional exploits quickly.
“The time from patch to working exploit is shrinking for structural reasons,” Moses wrote. He explained that historically, most exploitation occurred after a public PoC was released, with a limited number of capable actors building exploits and others waiting. Today, AI‑assisted analysis can turn a patch diff or advisory into a working exploit at lower cost, allowing a broader range of actors to act within hours or even minutes of disclosure.
The AWS team concluded that PHP2Shell is now being broadly exploited in the wild, though it remains unclear how many real‑world systems have been compromised. The PHP Foundation did not respond to requests for comment.
Overall, the findings illustrate a shifting threat landscape where the window for defensive action narrows dramatically. Organizations are urged to prioritize rapid patch deployment and to consider the potential for pre‑disclosure exploitation, especially for widely used components such as PHP that power countless web applications worldwide.
Helene Elliott is the Lead Science & Space Reporter at News Raise. She reports on aerospace missions, astrophysics discoveries, quantum research, and environmental technology.
