Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.
A critical PHP vulnerability, dubbed PHP2Shell, was discovered on October 17, but its discovery was not disclosed until Wednesday. Researchers from Amazon Web Services (AWS) observed an attempted exploit on October 17, four days prior to the official disclosure. The exploit attempt originated from an IP address associated with a commercial anonymization network, suggesting the action was likely carried out by a threat actor.
Despite the exploit being under embargo, it appeared to be reverse engineered quickly once the official patch was released. AWS analysts detected multiple exploitation attempts in the days leading to the disclosure, indicating the involvement of various threat actors. The PHP Foundation has not yet commented on the matter. While the specifics of the October 17 exploit remain unclear, AWS emphasizes the importance of accelerating vulnerability disclosure in light of the growing use of AI tools that can expedite the development of new exploits.
Written by urgent.news from Wired's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
