Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched

Key Points:

• Two critical vulnerabilities in PHP, known as PHP2Shell, were publicly patched on Wednesday, prompting a rapid global effort to secure websites and applications before widespread exploitation.
• Amazon Web Services (AWS) revealed that at least one attacker began exploiting the PHP2Shell vulnerabilities as early as October 17, four days before the public disclosure, detected through activity on their honeypot servers.
• Multiple exploitation attempts were observed around the time of the patch release, originating from anonymized IP addresses and suggesting involvement of various threat actors with different objectives.
• AWS highlighted that the acceleration of exploit development is driven by AI tools, which allow a broader range of attackers to quickly convert patch information into working exploits, reducing the window between patch release and active exploitation.
• These findings emphasize the need for faster and more coordinated vulnerability disclosure processes to mitigate risks in an environment where technical details can be rapidly weaponized by diverse threat actors.