Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched - WIRED
Hackers began exploiting critical PHP vulnerabilities days before a public patch was released, according to new research.
A pair of critical vulnerabilities in PHP, a widely used web scripting language, were actively exploited before security teams could patch them. The flaws, known collectively as PHP2Shell, were discovered by Amazon Web Services researchers on Wednesday, who found evidence of attacks dating back to October 17.
AWS analysts spotted the October 17 exploitation while reviewing activity on a honeypot, an intentionally vulnerable server used to study attack methods. The attempt originated from an IP address linked to a commercial anonymization network, or proxy and VPN.
While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.
Proof-of-concept exploits for PHP2Shell began appearing publicly on Wednesday, with some surfacing hours before the official disclosure at 10 am ET. AWS researchers say their honeypots were hit with multiple anonymized attempts in the hours leading up to the release, indicating multiple actors.
The PHP Foundation did not immediately respond to a request for comment. AWS emphasizes that the findings underscore how coordinated vulnerability disclosure must evolve and speed up given global access to AI tools that can accelerate vulnerability analysis and allow less technically proficient actors to quickly develop new exploits.
CJ Moses wrote that the time from patch to working exploit is shrinking for structural reasons. In the past, most exploitation came after a public proof of concept was released, but that dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit, allowing more actors to act within hours or even minutes once technical details are disclosed.
Related
