php2shell Probes Began Four Days Before Disclosure, Amazon Says

The race to patch PHP started before anyone knew there was a race.

Amazon’s CJ Moses writes that an exploit attempt for php2shell hit Amazon’s MadPot honeypot on October 17, four days before the PHP fixes went public, from an anonymization network. More attempts from multiple actors followed between 02:00 and 08:00 UTC on October 21. “PHP2Shell is now being broadly exploited in the wild,” Amazon says. It is unclear whether those attempts would have succeeded, it adds.

Marcus Hutchins told SecurityWeek the event is “like 50% the way towards Log4J.” CISA urged updates to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. JFrog warns of fake proofs of concept and prank malware.

Amazon’s advice: investigate from October 17 on, and measure patch deadlines in hours.

@levelsio, who took his sites offline before Wednesday’s patch, says this will not be the end of PHP. AI-assisted exploits will reach every language and framework, he writes: “A new era of cybersecurity has begun.” @TheRundownAI leads its top stories with the PHP flaws, and MIT Technology Review’s newsletter says AI “has uncovered a decade-old flaw threatening much of the web.”