AWS detected PHP2Shell exploit attempt four days before public disclosure

Amazon Web Services said on October 21 that its threat monitoring system recorded an attempt to exploit critical PHP vulnerabilities on October 17, four days before the flaws were publicly disclosed and fixes were released. The early attempt means security teams checking for PHP2Shell activity may need to examine records from before the public alert.

The attempt targeted MadPot, an AWS system designed to attract malicious activity, and came from an IP address associated with a commercial anonymization network. AWS chief information security officer CJ Moses said that combination suggested a threat actor, but it was unclear how the actor obtained exploit information while the flaws were under embargo. AWS said it could not tell whether any of the attempts it observed would have succeeded against a real-world system.

Attempts appeared before the PHP fixes

PHP developers released fixes on October 21 and urged users to update immediately, Reuters reported. AWS advised security teams investigating possible PHP2Shell activity to look back at least as far as October 17, the date of its earliest observed attempt. That date marks an attempt against AWS's monitoring system, rather than a confirmed breach of a website or service.

Reported attempts surged after disclosure

Cloudflare chief executive Matthew Prince said the company's network saw thousands of exploitation attempts in the 10 hours before the public announcement, according to Reuters. He said the count rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and then millions. Those figures describe attempts across Cloudflare's network; they do not establish that the attacks succeeded.

Some companies and governments took sites or services offline as a precaution while fixes were applied, Reuters reported. Finland's government IT provider Valtori said its service interruptions were not caused by exploitation of the vulnerabilities or by a cyber breach, and that it was unaware of active exploitation of the flaws affecting its systems.

Elizabeth Barron, executive director of the PHP Foundation, told WIRED the organization had not known about AWS's findings before they were published and did not immediately have a comment on them. WIRED reported that the foundation knew of no successful remote-code-execution attempt. AWS said its technical analysis was continuing.