Security researchers have revealed that attackers began exploiting critical flaws in the PHP scripting language days before official fixes were made public. The discovery highlights a rapidly shrinking window for organizations to protect their systems, as threat actors move faster to reverse-engineer patches and develop working exploits.
Amazon Web Services (AWS) analysts identified the early activity on Wednesday while reviewing logs from a honeypot, a digital lure designed to attract and study attackers. The honeypot recorded an exploitation attempt on October 17, four days before the vulnerabilities were publicly disclosed and patched on Wednesday.
Early Exploitation Detected on Honeypot
The October 17 attempt originated from an IP address linked to a commercial anonymization network, according to AWS. This suggests the activity was conducted by a threat actor using proxy services to hide their identity. The specific identity of the actor remains unknown.
CJ Moses, AWS chief information security officer, noted in a research post that while the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address indicates deliberate action by a threat actor. He stated it remains unclear how the actor acquired exploit information prior to the public disclosure.
On the day of the public disclosure, AWS researchers observed multiple exploitation attempts hitting their honeypots. These attempts were anonymized using various providers and appeared to have different attack goals, likely indicating multiple distinct actors. Technical analysis is ongoing to determine if any of these attempts would have succeeded in real-world systems.
Shrinking Window for Defense
The incident underscores a structural shift in cybersecurity. The time between a patch release and the availability of a working exploit is decreasing. In the past, most exploitation occurred after public proof-of-concept code was released, allowing only a small number of capable actors to build exploits while others waited.
Moses explained that this dependency is weakening. AI-assisted analysis makes it cheaper and faster to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed.
Proof-of-concept exploits for the vulnerabilities, known collectively as PHP2Shell, began emerging publicly on Wednesday. Some appeared hours before the official 10 am ET disclosure. AWS analysts noted that PHP2Shell is now being broadly exploited in the wild.
Some governments and other groups proactively took key websites down in anticipation of the release to avoid being targeted before they could apply the patches. However, the early exploitation detected by AWS suggests that some actors were already prepared or had access to information before the embargo ended.
The PHP Foundation did not immediately respond to requests for comment regarding the early exploitation. AWS emphasizes that these findings highlight the need for coordinated vulnerability disclosure to evolve and speed up, given global access to AI tools that accelerate vulnerability analysis.
Source: Wired
