PHP2Shell Flaws "Broadly Exploited": Amazon Says Attacks Began Four Days Before Patches

What happened

AWS CISO CJ Moses said the company's decoy servers saw PHP2Shell exploitation attempts on Oct 17, four days before patches shipped; the attacks came from IPs associated with a commercial anonymization network while the flaws were still under embargo, and Amazon does not know how the attackers learned of the bugs early. Varied payloads and anonymization infrastructure suggest multiple actors; technical analysis is ongoing and it is unclear whether the attempts would have succeeded in real-world systems.

On Oct 21 the PHP project shipped emergency patches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older no longer receive official security updates. Both flaws are critical remote-code-execution vulnerabilities letting attackers run code on a server without logging in; VirusTotal tracks more than 5.1 million PHP hosts exposed online.

Dataminr's threat research team reported the same day that observed activity since disclosure has been limited to scanning, fingerprinting and non-working exploits, with "no known compromises," though working proofs-of-concept or successful exploitation is "only a matter of time." PHP Foundation executive director Elizabeth Barron told The Verge that to her knowledge there has been no successful remote code execution, but updating is "imperative." Moses warned defenders should not assume the public disclosure date is the earliest date of exploitation.

Key facts

1. Timeline: first attacks Oct 17, patches shipped Oct 21; multiple proof-of-concept exploits appeared within hours of disclosure.
2. Before disclosure, multiple security companies including Cloudflare, watchTowr, Previdian, Hadrian and Patchstack detected unsuccessful exploitation attempts; some flaw details leaked before the official release.
3. Impact: PHP powers roughly 70–80% of websites whose programming language can be identified, including WordPress, Drupal and Joomla.