PHP2Shell critical PHP flaws exploited in the wild from Oct 17, four days before public disclosure and patches
Amazon Web Services (AWS) research indicates that at least one actor began attempting to exploit two critical PHP vulnerabilities, collectively called PHP2Shell, on October 17. That was four days before the fixes and public disclosure on Wednesday, October 21, at 10 am ET. AWS found the activity by reviewing honeypot logs. The attempt came from an IP address linked to a "commercial anonymization network" (a proxy network or VPN). It remains unclear how the actor obtained exploit information while the flaws were under embargo. AWS CISO CJ Moses stated that "PHP2Shell is now being broadly exploited in the wild."
Entenda a falha
A vulnerabilidade
PHP2Shell is the collective name for two critical vulnerabilities in PHP, with fixes released on Wednesday, October 21 at 10 am ET. The articles give no CVE IDs, flaw types, affected or fixed versions, or attacker prerequisites. AWS says PHP2Shell is now being broadly exploited in the wild, so any site or app running PHP should be checked against the vendor's patched releases.
Como foi descoberta
The flaws were under embargo until the coordinated disclosure and patches on October 21. AWS analysts, reviewing honeypot logs after the disclosure, found an exploitation attempt on October 17 from an IP address linked to a commercial anonymization network (proxy or VPN). AWS CISO CJ Moses said it is unclear how the actor obtained exploit information before disclosure. In the hours before disclosure, AWS honeypots received more attempts through various providers with seemingly different goals, likely from several actors. After the patches, attackers also reverse engineered the fixes. The PHP Foundation had not responded to WIRED.
PoC pública
According to WIRED, proof-of-concept exploits for PHP2Shell began appearing publicly on October 21, some apparently hours before the 10 am ET disclosure. The articles do not name who published them, where, or how they work. AWS says technical analysis is ongoing and it is unclear whether the observed attempts would have succeeded against real systems. Given public PoCs and broad exploitation, patching should be treated as urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 00:16.
Detalhes técnicos
- Proof-of-concept exploits began appearing publicly on October 21, some apparently hours before the 10 am ET disclosure.
- In the hours before disclosure, AWS honeypots received multiple exploitation attempts. They were anonymized through various providers and had seemingly different attack goals, likely indicating multiple actors.
- AWS says technical analysis is ongoing and it is unclear whether any of these attempts would have succeeded against real-world systems.
- Attackers also reverse engineered the fixes to learn how to exploit the flaws.
- AWS argues that AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit, so more actors can act within hours or minutes of disclosure.
- The article does not give CVE identifiers, affected versions or IOCs.
Remediação
- Administrators raced to identify and patch vulnerable websites and apps after the fixes were released on October 21.
- Some governments and other groups proactively took key websites offline ahead of the release so they would not be targeted before patching.
- AWS says coordinated vulnerability disclosure must evolve and speed up.
Linha do tempo
-
PHP2Shell critical PHP flaws exploited in the wild from Oct 17, four days before public disclosure and patches
ler a análise desta fonte ocultar
Amazon Web Services (AWS) research indicates that at least one actor began attempting to exploit two critical PHP vulnerabilities, collectively called PHP2Shell, on October 17. That was four days before the fixes and public disclosure on Wednesday, October 21, at 10 am ET. AWS found the activity by reviewing honeypot logs. The attempt came from an IP address linked to a "commercial anonymization network" (a proxy network or VPN). It remains unclear how the actor obtained exploit information while the flaws were under embargo. AWS CISO CJ Moses stated that "PHP2Shell is now being broadly exploited in the wild."
Technical Details
- Proof-of-concept exploits began appearing publicly on October 21, some apparently hours before the 10 am ET disclosure.
- In the hours before disclosure, AWS honeypots received multiple exploitation attempts. They were anonymized through various providers and had seemingly different attack goals, likely indicating multiple actors.
- AWS says technical analysis is ongoing and it is unclear whether any of these attempts would have succeeded against real-world systems.
- Attackers also reverse engineered the fixes to learn how to exploit the flaws.
- AWS argues that AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit, so more actors can act within hours or minutes of disclosure.
- The article does not give CVE identifiers, affected versions or IOCs.
Remediation
- Administrators raced to identify and patch vulnerable websites and apps after the fixes were released on October 21.
- Some governments and other groups proactively took key websites offline ahead of the release so they would not be targeted before patching.
- AWS says coordinated vulnerability disclosure must evolve and speed up.