PHP2Shell Attacks Began Before Public Patch Release
Amazon Web Services found honeypot traffic on October 17 that tried to exploit the PHP2Shell flaws, four days before fixes were released. The attempts came through an anonymized network, and researchers say the bugs are now being widely attacked. It is still unknown how the attacker learned about the vulnerabilities before public disclosure.
AWS researchers reviewing honeypot logs on Wednesday found an earlier attempt dated October 17, four days before fixes for the PHP2Shell flaws became public. The traffic came from an address linked to a commercial anonymization service; AWS said this suggested a threat actor.
The bugs affect PHP, a common language for building websites and web apps. As patches arrived, administrators rushed to locate exposed systems, while some governments preemptively removed key sites from service to avoid attacks before updates could be applied.
The early exploitation could increase pressure on website operators and hosting providers to patch quickly, potentially disrupting services if sites are taken offline defensively. Ordinary users may face greater risk of data exposure or account compromise if vulnerable PHP applications remain unpatched. Because exploit development may accelerate with AI-assisted analysis, smaller organizations with limited security staff could struggle to keep pace, widening gaps in digital safety.