AWS Finds Exploitation of PHP2Shell Bugs Days Before Public Patch Release

Amazon Web Services (AWS) researchers discovered that a threat actor began probing a honeypot for the PHP2Shell vulnerabilities on October 17, four days before the vulnerabilities were publicly disclosed and patched on Wednesday. The attempt originated from an IP address linked to a commercial anonymization network, suggesting the use of a proxy or VPN.

AWS chief information security officer CJ Moses said the activity occurred while the vulnerabilities were still under embargo, and that the actor’s method of acquiring exploit information before disclosure remains unclear. He added that multiple anonymized IPs targeted the honeypots in the hours leading up to the public announcement, indicating several possible attackers.

"While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," Moses wrote.

"Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems," he said, noting that "PHP2Shell is now being broadly exploited in the wild."

Proof-of-concept exploits for PHP2Shell appeared publicly on the day of the patch release, some emerging hours before the official disclosure at 10 a.m. ET. AWS highlighted that the rapid transition from patch to working exploit is being driven by AI-assisted analysis, which shortens the time needed for less-experienced actors to develop functional exploits.

"The time from patch to working exploit is shrinking for structural reasons," Moses explained. "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."

The PHP Foundation did not respond to requests for comment.