PHP Vulnerabilities Exploited Prior to Public Disclosure

Amazon Web Services (AWS) reported that attempts to exploit critical vulnerabilities in PHP, known as PHP2Shell, began on October 17, just four days before the public disclosure of the flaws on October 21. This early activity highlights a significant security concern as the vulnerabilities are now being “broadly exploited” across the internet.

The vulnerabilities prompted urgent action from website administrators and security teams to patch their systems. However, attackers quickly reverse-engineered the fixes to exploit the flaws. Some organizations even took key websites offline in anticipation of the patch release to avoid being targeted.

AWS analysts identified the exploitation attempts while reviewing activity on their honeypots, which are intentionally vulnerable servers used to study attack methods. The attempts originated from an IP address associated with a commercial anonymization network, indicating that the attackers were likely using a proxy or VPN.

CJ Moses, AWS’s chief information security officer, noted that while the vulnerability was under embargo, the targeting of the honeypot suggests that the attacker had prior knowledge of the exploit. The exact method by which the exploit information was obtained remains unclear.

Following the public disclosure, proof-of-concept exploits for PHP2Shell appeared online, some reportedly just hours before the official announcement. AWS observed multiple exploitation attempts on their honeypots, indicating that various actors may be involved in exploiting the vulnerabilities.

Moses emphasized the need for a faster and more coordinated approach to vulnerability disclosure, especially given the accessibility of AI tools that can expedite vulnerability analysis. He pointed out that the time from patch release to the development of working exploits is decreasing, allowing more attackers to act quickly once vulnerabilities are disclosed.

As the situation develops, the PHP Foundation has not yet responded to requests for comment regarding the ongoing exploitation of these vulnerabilities.

Source: WIRED