The Internet’s mad scramble on Wednesday to fix a pair of critical vulnerabilities in PHP, a widely used web scripting language, was already too late to stop each attack, newly released details reveal. Wednesday’s release of fixes for two critical vulnerabilities in PHP sent administrators and security personnel scrambling to identify and patch vulnerable websites and applications, while attackers inevitably reverse-engineered the fixes to learn how to exploit the flaws. Some governments and other groups even proactively shut down key websites in anticipation of the release, so that they would not be attacked before they could apply patches. But in addition to detecting such active exploitation on Wednesday, research published late Wednesday by Amazon Web Services indicates that at least one actor had begun attempting to exploit the bugs, known collectively as PHP2Shell, on October 17, four days before Wednesday’s public revelations. AWS analysts detected the October 17 exploit on Wednesday while analyzing activity on one of them. of their so-called honeypots, or intentionally vulnerable web servers or other digital honeypots that help researchers study attack methods and trends. The attempt came from an IP address that AWS says is linked to a “commercial anonymization network,” in other words, a proxy or VPN network. “While the vulnerability was under embargo, targeting a honeypot from an anonymous IP address suggests the activity was performed by a threat actor, although it is unclear how the actor acquired exploitative information prior to its disclosure,” CJ Moses, AWS’s chief information security officer, wrote in the research post. Proof-of-concept exploits for PHP2Shell began emerging publicly on Wednesday, with some appearing hours before the public disclosure at 10 a.m. ET. In the hours leading up to the disclosure, AWS researchers say their honeypots were hit by multiple anonymized exploitation attempts using multiple vendors and apparently with multiple attack targets, likely indicating multiple different actors. “Technical analysis is ongoing and it is unclear whether any of these attempts would have been successful in real-world systems,” Moses wrote. He added that “PHP2Shell is now being widely exploited in the wild.” The PHP Foundation did not immediately respond to WIRED’s request for comment. Although it is not clear how the October 17 exploit occurred or where it came from, AWS emphasizes that the findings underscore how coordinated vulnerability disclosure must evolve and accelerate given global access to artificial intelligence tools that can speed up vulnerability analysis and allow less technically proficient actors to quickly develop new exploits. “The time from patch to functional exploit is reducing for structural reasons,” Moisés wrote. “In the past, most of the exploitation we saw occurred after a public proof of concept was released. A small number of capable actors created exploits, and everyone else waited for them. That dependence is weakening. AI-assisted analysis makes it cheaper to turn a patch or advisory into a working exploit. As a result, more actors can act within hours or even minutes once the technical details of a vulnerability are revealed.”
