Administrators racing to patch two critical PHP vulnerabilities are confronting an unwelcome detail: attempted exploitation appears to have started before the flaws were publicly disclosed.
Amazon Web Services said it found an attempted attack dating to October 17 while reviewing activity recorded by one of its deliberately vulnerable internet-facing systems. Public fixes for the vulnerabilities, collectively called PHP2Shell, were released on October 21. AWS says the gap indicates that at least one actor may have had exploit information before the public release.
Activity before disclosure
Honeypots are systems configured to look vulnerable so that defenders can observe attack techniques and broader threat activity. According to AWS, the October 17 attempt came from an IP address associated with a commercial anonymization network, such as a proxy or VPN service.
AWS said the use of an anonymized source address suggested threat-actor activity, but it could not determine how the actor obtained information about the vulnerabilities before disclosure. That uncertainty matters: the observation identifies suspicious targeting, not a confirmed explanation for the apparent early access.
The public release of patches triggered a familiar and urgent response across the internet. Organizations needed to identify PHP-dependent sites and applications, determine whether they were exposed, and apply fixes. Some groups reportedly took websites offline in advance of the disclosure to reduce their risk while patching preparations were underway.
Exploitation is now broader
Once fixes became available, public proof-of-concept exploits began appearing. AWS says some surfaced hours before the scheduled 10 a.m. Eastern public disclosure. Its researchers also saw multiple exploitation attempts against honeypots in the hours leading up to disclosure, using different anonymization providers and apparently pursuing different attack goals.
That pattern may point to more than one actor, although AWS cautioned that its technical analysis is ongoing. It also said it was unclear whether all of the observed attempts would have succeeded against real-world systems. Still, the company’s assessment is that PHP2Shell is now being broadly exploited in the wild.
The episode illustrates why the period around a critical vulnerability disclosure is often especially hazardous. Defenders must make operational decisions quickly, while attackers can examine released patches and use them to infer the underlying flaws. In this case, AWS’s retrospective finding suggests the defensive window may have been narrower than normal for some systems.
What the finding does and does not establish
The available evidence does not establish who was behind the October 17 activity, whether an exploit succeeded, or how information about the flaws was obtained. It does establish that AWS recorded an attempt targeting a honeypot before the vulnerabilities were publicly revealed.
For security teams, the practical implication is immediate rather than speculative: identify affected PHP deployments, apply the released fixes, and investigate for signs of attempted exploitation. Organizations should treat the vulnerabilities as an active incident-management concern, not simply as a routine maintenance item.
PHP is widely used for web applications, which makes the speed of the response important. Internet-facing services can include direct PHP applications as well as products and platforms that depend on PHP behind the scenes. Asset inventories, ownership clarity and fast testing paths are therefore central to a response.
A short lesson in patch urgency
Public disclosure does not mark the beginning of risk; it often marks the moment risk becomes visible to a wider group of defenders and attackers. The PHP2Shell reports add another complication: attempted exploitation can precede that moment.
AWS’s evidence should not be read as a complete account of the incident, but it is a strong reason for affected organizations to move rapidly. The question for operators is no longer whether attackers will examine these flaws. AWS says exploitation is already widespread, making patching and investigation the immediate priorities.
This article is based on reporting by Wired. Read the original article.
Originally published on wired.com
