Amazon: PHP2Shell probes began four days before patch

Amazon reported that hackers began probing for servers vulnerable to two critical PHP flaws, collectively called PHP2Shell, four days before the PHP Foundation and its industry partners released patches on October 21, according to digitaltoday.co.kr.

Amazon said the first attack attempts came from an anonymizing network on October 17, while the vulnerabilities were still private. Vulnerability details leaked online on October 20, and attack code spread quickly afterward. Amazon said multiple hackers appear to be involved and that PHP2Shell is now widely exploited.

Cloudflare CEO Matthew Prince said attack attempts rose from thousands before disclosure to hundreds of thousands within two hours, and now number in the millions, the report said.

Patch gap leaves about 1.57 million hosts exposed

Censys counted about 1.57 million internet-connected PHP hosts that remained unpatched as of October 21, and VulnCheck said at least 1 million hosts run end-of-life PHP versions.

CISA advised updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately on October 21, the outlet reported.

WatchTowr said most of the circulating attack code does not work or only crashes target servers. Experts compared PHP2Shell to the Log4Shell vulnerability; in that incident, according to the background cited, finding where the vulnerable Log4j library was used proved difficult.