Hackers Exploit PHP Vulnerabilities Before Patches Released
Hackers took advantage of PHP vulnerabilities days before patches were made available, highlighting the need for faster vulnerability disclosure. This exploitation may have significant consequences for website and app security.
Original reporting · wired.com
Original: “Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched”
Read “Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched” at WIRED AI →
How this was written. Diagnosis Forward wrote this article with a language model from WIRED AI’s reporting (model: @cf/meta/llama-3.3-70b-instruct-fp8-fast); it describes that reporting rather than adding to it. The original, linked above, is the full story.
Key points from WIRED AI’s report
- Hackers exploited PHP vulnerabilities days before patches were released, highlighting the need for faster vulnerability disclosure.
- The exploitation was discovered by AWS researchers analyzing activity on one of their honeypots.
- The use of AI tools is accelerating vulnerability analysis and allowing less technically proficient actors to develop new exploits.
- The time between patch release and exploitation is decreasing, making rapid vulnerability disclosure and patching crucial.
- Coordinated vulnerability disclosure must evolve to address the changing landscape of vulnerability exploitation.
A recent scramble to patch critical vulnerabilities in PHP, a widely used web scripting language, was too late to prevent some attacks. According to WIRED AI, administrators and security staff rushed to identify and patch vulnerable websites and apps on Wednesday. Some groups even took proactive measures, such as taking key websites down temporarily, to prevent potential attacks.
The vulnerabilities, known as PHP2Shell, were exploited by at least one actor on October 17, four days before the public release of fixes. Researchers at Amazon Web Services discovered this exploitation while analyzing activity on one of their honeypots, which are intentionally vulnerable web servers used to study attack methods.
The attempt to exploit the bugs came from an IP address linked to a commercial anonymization network, making it difficult to determine the identity of the attacker. AWS analysts believe the activity was conducted by a threat actor, but it is unclear how the actor obtained information about the exploit before it was publicly disclosed.
On Wednesday, proof-of-concept exploits for PHP2Shell began emerging publicly, with some appearing hours before the official disclosure. AWS researchers reported that their honeypots were hit with multiple exploitation attempts, likely indicating the involvement of multiple different actors.
The exploitation of PHP2Shell is now widespread, according to CJ Moses, AWS's chief information security officer. Technical analysis is ongoing to determine the success of these attempts in real-world systems. The PHP Foundation has not yet commented on the situation.
The findings highlight the need for coordinated vulnerability disclosure to evolve and speed up, given the increasing accessibility of AI tools. These tools can accelerate vulnerability analysis, allowing less technically proficient actors to quickly develop new exploits. As a result, the time between patch release and exploitation is decreasing.
In the past, most exploitation occurred after a public proof of concept was released, but this is no longer the case. With the help of AI-assisted analysis, more actors can develop working exploits within hours or minutes of technical details being disclosed. This shift underscores the importance of rapid vulnerability disclosure and patching.
Questions and answers
What is PHP and why is it important?
PHP is a widely used web scripting language, and its vulnerabilities can have significant consequences for website and app security.
How did hackers exploit the PHP vulnerabilities?
Hackers exploited the vulnerabilities by using information that was available before the public release of fixes, but the exact method is unclear.
What is the impact of AI tools on vulnerability exploitation?
AI tools are accelerating vulnerability analysis, allowing less technically proficient actors to quickly develop new exploits and decreasing the time between patch release and exploitation.
