Hackers Targeted PHP2Shell Flaws Days Before Patch Release

Hackers began exploiting the PHP2Shell vulnerabilities on October 17, four days before the public patch was issued, AWS researchers reported. Wednesday saw the release of fixes for two critical PHP bugs, prompting a rush among web admins to patch sites and apps. Some governments pre‑emptively shut down key websites to avoid being hit before patches could be applied. AWS spotted the early attack while reviewing logs from a deliberately vulnerable honeypot; the traffic came from an IP tied to a commercial anonymisation network, suggesting a threat actor was involved. CJ Moses, AWS’s chief information security officer, said the source of the exploit details before disclosure remains unclear. Proof‑of‑concept exploits for PHP2Shell appeared publicly just hours before the official announcement at 10 a.m. ET, and AWS observed multiple anonymous attempts with varied goals, indicating several actors may have been testing the flaws. The agency could not confirm whether any of these attempts would have succeeded in real‑world systems, but it noted that PHP2Shell is now being broadly exploited online. The PHP Foundation did not respond to requests for comment. AWS emphasized that the speed of AI‑assisted analysis is shrinking the gap between a patch’s release and the availability of working exploits, urging faster coordinated disclosure to stay ahead of increasingly capable attackers.

Context

PHP powers a large share of websites, so bugs in its core can affect many online services. AI tools can quickly turn a patch description into a working exploit, allowing less skilled hackers to launch attacks soon after a vulnerability is disclosed.