Attackers were already exploiting critical PHP vulnerabilities, dubbed PHP2Shell, days before the official patches were released, according to new findings from Amazon Web Services (AWS).
While the tech world scrambled to patch two major security holes in PHP on Wednesday, it turns out some bad actors had already gotten a head start. The fixes for these vulnerabilities were released to the public, prompting a mad dash by system administrators to secure websites and applications. However, attackers were quick to reverse-engineer the patches to figure out how to exploit the flaws.
AWS researchers discovered evidence of exploitation attempts on October 17, a full four days before the vulnerabilities were publicly disclosed. These attempts were detected on one of AWS's "honeypots"—servers intentionally set up to attract and study cyberattacks—originating from an IP address linked to a commercial anonymization network, suggesting a sophisticated threat actor.
"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor," said CJ Moses, AWS's chief information security officer. "It remains unclear how the actor acquired exploit information prior to disclosure."
Proof-of-concept exploits for PHP2Shell began appearing online on Wednesday, some surfacing hours before the official announcement. AWS noted multiple anonymized exploitation attempts hitting their honeypots in the lead-up to the disclosure, indicating potential activity from several different threat groups. While it's uncertain if these specific attempts were successful on real-world systems, Moses confirmed that "PHP2Shell is now being broadly exploited in the wild."
These findings highlight the evolving landscape of cybersecurity, especially with the rise of AI tools. Moses emphasized that the window between a patch being released and exploits becoming available is rapidly shrinking. "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit," he explained. "As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."
