Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
On Wednesday, the rush to patch two critical vulnerabilities in PHP, a commonly used web scripting language, was already too late to prevent some attacks, according to newly revealed information. The release of patches for these flaws triggered a frantic effort among administrators and security professionals to identify and secure vulnerable websites and applications. Meanwhile, malicious actors quickly reverse-engineered the patches to exploit the bugs. Some governments and organizations even took important websites offline proactively, anticipating the patch release to avoid being targeted before applying fixes.
Further investigation by Amazon Web Services (AWS) revealed that at least one attacker had begun attempting to exploit these vulnerabilities—together known as PHP2Shell—as early as October 17, four days before the public disclosure. This discovery emerged during a review of activity on one of AWS’s honeypot systems, which are intentionally vulnerable digital traps designed to monitor and analyze cyberattack behaviors. The suspicious attempt originated from an IP address associated with a commercial anonymization network, such as a proxy or VPN.
AWS’s chief information security officer, CJ Moses, noted that this pre-disclosure targeting via anonymized IPs strongly indicated a threat actor’s involvement, though it remains unclear how they obtained exploit information before the vulnerabilities became public. Elizabeth Barron of the PHP Foundation stated that the organization had no prior knowledge of this research and did not immediately comment, but emphasized that upgrading remains critical, and to their knowledge, no successful remote code executions had occurred.
Proof-of-concept exploits for PHP2Shell began appearing online on the same day, some seemingly distributed hours before the official announcement. In the period leading up to the disclosure, AWS observed multiple exploitation attempts hitting their honeypots, anonymized through different providers and seemingly originating from various attackers with diverse objectives. Moses acknowledged that investigation is ongoing and it is not yet clear which attempts could have succeeded in real environments, but confirmed that PHP2Shell is now widely exploited in the wild.
While the origins and methods of the early October 17 exploit attempts remain uncertain, AWS stressed that these findings highlight how vulnerability disclosure processes must accelerate and adapt. This urgency is driven by global access to artificial intelligence tools, which significantly speed up vulnerability analysis, enabling less skilled attackers to quickly develop exploits. Moses explained that the lag between patch releases and the creation of working exploits is decreasing due to structural changes, with AI-assisted analysis lowering the barrier to converting patch information into effective attacks. Consequently, a broader range of actors can now launch exploits within hours or minutes after technical details become public.
