PHP2Shell: AWS spotted an operation attempt four days before the patches were published

A honey pot from Amazon Web Services was targeted as early as October 17, while PHP's critical flaws were still under embargo. They are now being exploited on a large scale.

The update race triggered on October 21 by the two PHP critical flaws, nicknamed " PHP2Shell", was not enough to get ahead of all attackers. By reviewing the activity of its honeypots — voluntarily vulnerable servers used to observe attacks — Amazon Web Services discovered that at least one actor had attempted to exploit these vulnerabilities as early as October 17, four days before their public disclosure. The request came from an IP address linked to a commercial anonymisation network, and AWS acknowledges that it did not know how this actor was able to obtain operating information during the embargo.

Proof of concept then circulated publicly the same day, some hours before the official announcement of 10 a.m. New York time. As a result, AWS honey pots recorded several waves of attempts with varied objectives, suggesting several distinct groups. According to CJ Moses, responsible for the security of AWS' information systems, PHP2Shell is now "widely exploited". Some jurisdictions and organizations had preferred to shut down their sites as a precaution before the patches were released.

AI shortens time between corrective and exploit

AWS learns a broader lesson: IA-assisted analysis makes it much less costly to move from a patch or security advisory to a functional feat. Where most attacks used to follow the publication of proof of concept by a handful of competent actors, an increasing number of attackers can now act in a matter of hours or even minutes. The coordinated disclosure of vulnerabilities will therefore, according to the company, have to accelerate and adapt.