Wednesday’s rush to patch two critical flaws in PHP was already too late to stop every attack, according to newly released details.
Administrators and security staff raced to fix vulnerable websites and apps on Wednesday. At the same time, attackers reverse engineered the fixes to learn how to exploit the flaws. Some governments and other groups even took key websites down in anticipation of the release so they would not be targeted before patches could be applied.
Attacks began four days early
Research published Wednesday evening by Amazon Web Services indicates at least one actor started attempting to exploit the bugs, known collectively as PHP2Shell, on October 17. This was four days before the public revelations.
AWS analysts spotted the October 17 exploitation on Wednesday while reviewing activity on one of their honeypots. These are intentionally vulnerable web servers or digital lures that help researchers study attack methods and trends. The attempt came from an IP address AWS says is linked to a commercial anonymization network, in other words a proxy network or VPN.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” CJ Moses, AWS’s chief information security officer, wrote in the research post.
Proof-of-concept exploits for PHP2Shell began emerging publicly on Wednesday. Some seemed to appear hours before the public disclosure at 10 am ET. In the hours leading up to the disclosure, AWS researchers say their honeypots were hit with multiple exploitation attempts anonymized using various providers and seemingly with various attack goals. This likely indicates multiple different actors. “Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems,” Moses wrote. He added that “PHP2Shell is now being broadly exploited in the wild.”
The PHP Foundation did not immediately respond to WIRED’s request for comment.
What it means
Though it is unclear how the exploitation on October 17 happened or where it came from, AWS emphasizes that the findings show how coordinated vulnerability disclosure must evolve and speed up. Global access to AI tools can accelerate vulnerability analysis and allow less technically proficient actors to quickly develop new exploits.
“The time from patch to working exploit is shrinking for structural reasons,” Moses wrote. “In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them. That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed.”
