Critical PHP Flaws Targeted by Attackers Before Patches Were Publicly Disclosed

The global rush to patch a pair of critical vulnerabilities in PHP, a widely used web scripting language, came too late to stop every attack, according to newly released details.

The fixes released on Wednesday prompted administrators and security teams to race to identify and patch vulnerable websites and applications, while attackers worked to reverse-engineer the patches and exploit the flaws. Some governments and other groups even took key websites offline proactively, hoping to avoid targeting before they could apply the updates.

But in addition to detecting active exploitation on Wednesday, research published Wednesday evening by Amazon Web Services indicated that at least one actor had begun attempting to exploit the bugs—known collectively as PHP2Shell—as early as October 17, four days before the public disclosures.

AWS analysts spotted the October 17 exploitation while reviewing activity on one of their honeypots, or intentionally vulnerable web servers and digital lures used to study attack methods and trends. The attempt came from an IP address that AWS said was linked to a commercial anonymization network, meaning a proxy network or VPN.

“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” CJ Moses, AWS’s chief information security officer, wrote in the research post.

Public proof-of-concept exploits for PHP2Shell began circulating on Wednesday, with some appearing hours before the public disclosure at 10 a.m. ET. In the hours leading up to the disclosure, AWS researchers said their honeypots were hit with multiple exploitation attempts anonymized using various providers and seemingly with various attack goals, likely indicating multiple different actors. “Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems,” Moses wrote. He added that “PHP2Shell is now being broadly exploited in the wild.”

The PHP Foundation did not immediately respond to WIRED’s request for comment.

Although it remains unclear how the October 17 exploitation happened or where it came from, AWS emphasized that the findings underscore how coordinated vulnerability disclosure must evolve and speed up, given global access to AI tools that can accelerate vulnerability analysis and allow less technically proficient actors to quickly develop new exploits.

“The time from patch to working exploit is shrinking for structural reasons,” Moses wrote. “In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them. That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed.”

Source link