Internet is crazy The battle to patch two critical vulnerabilities in PHP, a widely used web scripting language, as of Wednesday was already too late to stop each attack, newly released details reveal.
Wednesday’s release of patches for two critical PHP vulnerabilities sent administrators and security personnel scrambling to identify and patch vulnerable websites and applications, while attackers inevitably reverse-engineered the patches to learn how to exploit the flaws. Some governments and other groups even proactively took down key websites in anticipation of the release, so that they would not be targeted before they could apply the patches.
But in addition to detecting such active exploitation on Wednesday, a study released Wednesday evening by Amazon Web Services indicates that at least one actor had begun attempting to exploit the bugs – known collectively as PHP2Shell – on October 17, four days before Wednesday’s public disclosures.
AWS analysts spotted the Oct. 17 exploit Wednesday by examining activity on one of their so-called honeypots, or intentionally vulnerable web servers or other digital lures that help researchers study attack methods and trends. The attempt came from an IP address that AWS says is linked to a “commercial anonymization network,” i.e. a proxy or VPN network.
“While the vulnerability was embargoed, the targeting of a honeypot from an anonymized IP address suggests that the activity was conducted by a malicious actor, although it remains unclear how the actor acquired the exploit information before its disclosure,” CJ Moses, AWS chief information security officer, wrote in the research article.
Proof-of-concept exploits for PHP2Shell began appearing publicly on Wednesday, with some appearing hours before public disclosure at 10 a.m. ET. In the hours leading up to the disclosure, AWS researchers say their honeypots were hit by multiple anonymized exploitation attempts using various vendors and apparently with varying attack objectives, likely indicating multiple different actors. “Technical analysis is ongoing and it is unclear whether any of these attempts would have been successful in real systems,” Moses wrote. He added that “PHP2Shell is now widely exploited in the wild.”
The PHP Foundation did not immediately respond to WIRED’s request for comment.
While it’s unclear how the October 17 exploit occurred or where it came from, AWS points out that the findings highlight how coordinated vulnerability disclosure must evolve and accelerate given global access to AI tools that can accelerate vulnerability analysis and enable less technically savvy actors to quickly develop new exploits.
“The time between patching and exploitation of the exploit is decreasing for structural reasons,” Moses wrote. “In the past, most of the exploits we’ve seen have occurred after a public proof of concept has been released. A small number of skilled actors have built exploits, and everyone has been waiting for them. This dependency is weakening. AI-assisted analysis makes it less expensive to turn a patch or advisory into a working exploit. As a result, more actors can act within hours, or even minutes, once the technical details of a vulnerability are known. disclosed.”
Gn bussni
