AWS finds PHP2Shell exploitation began four days before PHP patches

The scramble on Wednesday to patch a pair of critical vulnerabilities in PHP, a widely used web scripting language, was already too late to stop every attack, according to WIRED's reporting on new research from Amazon Web Services.

Wednesday's release of fixes for the two flaws, known collectively as PHP2Shell, sent administrators and security staff racing to find and patch vulnerable sites and apps. Attackers, meanwhile, reverse engineered the fixes to learn how to exploit the bugs. Some governments and other groups even took key websites down ahead of the release so they would not be targeted before they could apply the patches.

AWS research published Wednesday evening indicates that at least one actor began trying to exploit the bugs on October 17, four days before the public disclosure. AWS analysts spotted that attempt on Wednesday while looking back at activity on one of their honeypots, which are intentionally vulnerable servers or other lures that help researchers study attack methods and trends. The attempt came from an IP address AWS links to a "commercial anonymization network", meaning a proxy network or VPN.

CJ Moses, AWS's chief information security officer, wrote in the research post that because the targeting happened while the vulnerability was under embargo, from an anonymized address, it suggests a threat actor was behind it. He added that it remains unclear how the actor got exploit information before disclosure.

Proof-of-concept exploits for PHP2Shell began appearing publicly on Wednesday, some seemingly hours before the public disclosure at 10 am ET. In the hours leading up to disclosure, AWS says its honeypots were hit with multiple exploitation attempts, anonymized through various providers and seemingly pursuing various goals, which likely points to several different actors. Moses wrote that technical analysis is ongoing and that it is unclear whether any of these attempts would have worked against real-world systems. He also wrote that PHP2Shell is now being broadly exploited in the wild.

Elizabeth Barron, executive director of the PHP Foundation, told WIRED the organization was unaware of AWS's research before publication and had no immediate comment on the findings. She added: "Although we agree that upgrading is absolutely imperative, to our knowledge, there has been no successful attempt at remote code execution."

AWS says the findings show that coordinated vulnerability disclosure must evolve and speed up, given global access to AI tools that can accelerate vulnerability analysis and let less technically proficient actors build exploits quickly. Moses argued that the time from patch to working exploit is shrinking for structural reasons. In the past, most exploitation came after a public proof of concept; a small number of capable actors built exploits and everyone else waited. That dependency is weakening, he wrote, because AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit, so more actors can act within hours or even minutes of technical details being disclosed.

Key facts

• AWS research says at least one actor tried to exploit the two critical PHP flaws (PHP2Shell) on October 17, four days before the public disclosure and patches.
• The October 17 attempt hit an AWS honeypot from an IP address linked to a commercial anonymization network, such as a proxy network or VPN.
• In the hours before the 10 am ET disclosure, AWS honeypots saw multiple exploitation attempts that likely came from several different actors.
• AWS says it is unclear how the actor got exploit information under embargo, or whether the attempts would have worked on real systems; the PHP Foundation knows of no successful remote code execution.
• AWS's CISO CJ Moses says AI-assisted analysis is shrinking the time from patch to working exploit to hours or even minutes.

Why it matters

Patching is normally treated as a race that starts at disclosure. AWS's findings suggest that for PHP2Shell the race may have started earlier, with an attempt on October 17 while the flaws were still under embargo. AWS also argues that AI-assisted analysis is making patch-to-exploit times shorter, which it says means coordinated vulnerability disclosure must evolve and speed up.

Who it affects

Anyone running websites or apps on PHP, described in the article as a widely used web scripting language, and the administrators and security teams responsible for patching them. Some governments and other groups took key websites down ahead of the patch release rather than leave them exposed. The finding also bears on the people who manage embargoed disclosure, since the source says it is unclear how the actor learned of the bugs early.

How to use it

The takeaway for defenders is to apply the PHP fixes released on Wednesday. The PHP Foundation's Elizabeth Barron said the organization agrees that upgrading is absolutely imperative. AWS says PHP2Shell is now being broadly exploited in the wild, so waiting is not a safe option.

How solid is it

The core finding comes from AWS's own honeypot data, written up by its chief information security officer CJ Moses and reported by WIRED. It is a single observed attempt from an anonymized address, and AWS says the activity "suggests" a threat actor rather than proving one. Technical analysis is ongoing. The PHP Foundation said it was unaware of the research before publication and had no immediate comment on the findings.

Risks and caveats

AWS says it remains unclear how the actor acquired exploit information before disclosure, and it is unclear whether any of the attempts would have succeeded in real-world systems. The PHP Foundation says it knows of no successful remote code execution. The actor is not identified. The AI argument is a general claim about shrinking exploit timelines; the source does not say AI was used in the October 17 attempt.

“The time from patch to working exploit is shrinking for structural reasons.”

— CJ Moses, chief information security officer, AWS