Organisations Face Early PHP2Shell Exploits Before Public Patch Release

Organisations relying on PHP web servers face immediate risk as attackers exploit critical flaws before patches are applied. Amazon Web Services research indicates that exploitation of the PHP2Shell vulnerabilities began four days prior to the public release of fixes. This early activity suggests that threat actors had access to exploit details while the vulnerabilities were still under embargo.

Who is affected by these exploits?

Any organisation running websites or applications built on PHP is potentially affected. The vulnerabilities, collectively known as PHP2Shell, are critical flaws in the widely used web scripting language. AWS analysts noted that their honeypots were targeted by multiple actors using various anonymisation providers. This indicates that the attacks are not limited to a single threat group but involve several different actors with varying goals.

How early did the attacks start?

According to AWS, exploitation attempts were first logged on 17 October. This date is four days before the public revelations and patch release on Wednesday. The initial attempt was detected when researchers reviewed activity on an intentionally vulnerable server. The traffic originated from an IP address linked to a commercial anonymisation network, such as a proxy or VPN, rather than a direct source.

What is the current status of the threat?

The PHP2Shell flaws are now being broadly exploited in the wild, according to CJ Moses, AWS’s chief information security officer. Proof-of-concept exploits emerged publicly on Wednesday, some appearing hours before the official disclosure at 10 am ET. AWS researchers observed multiple exploitation attempts against their honeypots in the hours leading up to the disclosure. It remains unclear if all these attempts succeeded on real-world systems.

Why did attackers act before the patch?

It is unclear how the actors acquired exploit information prior to the public disclosure. The targeting of honeypots from anonymised IP addresses suggests coordinated threat activity during the embargo period. Some governments and groups proactively took key websites down in anticipation of the release to avoid being targeted before applying patches. This highlights the difficulty of securing systems during the window between vulnerability discovery and public patching.

What affected people can do

Teams should immediately verify whether their PHP installations are updated to the latest patched versions. Check server logs for unusual activity or connections from anonymised networks, particularly around the time of the disclosure. Monitor for any signs of unauthorised shell access or data exfiltration. Be wary of follow-up phishing attempts that may reference this incident to trick staff into revealing credentials or installing malware.

What to do and how to stay safe: PHP

• Audit all web servers to confirm they are running the patched version of PHP.
• Review access logs for anomalies or connections from known proxy networks.
• Monitor for unexpected shell commands or unauthorised file changes on servers.
• Educate staff to recognise phishing emails that exploit this recent security news.

Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When did the PHP2Shell exploits start?

AWS detected exploitation attempts on 17 October, four days before the public patch release.

Are these vulnerabilities being actively used?

Yes, AWS states that PHP2Shell is now being broadly exploited in the wild.

Did AWS confirm if the attacks succeeded?

It is unclear if the attempts against honeypots would have succeeded on real-world systems.