Wired reported on Wednesday that Amazon Web Services (AWS) saw an early attempt to exploit two critical flaws in PHP, a widely used web scripting language. The flaws are called PHP2Shell. AWS research indicates at least one actor tried to exploit them on October 17, four days before the public fixes. AWS spotted this in a honeypot, a decoy server built to attract attackers. The traffic came from an address AWS links to a commercial proxy or VPN network. Other decoys took more attempts in the hours before disclosure, likely from several actors.
CJ Moses, AWS's chief information security officer, wrote that it is unclear how the actor got exploit details during the embargo, the period of agreed secrecy. AWS is still analysing and does not know if any attempt would work on real systems. A decoy hit shows someone tried, not that a real site fell. AWS says attacks using PHP2Shell are now widespread.
AWS's data suggest an embargo may not keep a flaw quiet. AWS argues AI tools make it cheaper to turn a patch diff, the list of code changes in a fix, into a working exploit, so more actors can strike within hours. Ask how fast critical patches reach production. Ask whether vendors patch PHP-based products on that timeline, and whether your PHP is managed or run by you.