Amazon Caught PHP2Shell Exploitation Attempts Four Days Before Disclosure
Attack traffic against a decoy system predates the official patch window, so the leak-driven early disclosure did not start the exploitation clock.
Reporting from 1 source: GIGAZINE.
Amazon Threat Intelligence detected attacks trying to exploit the PHP flaw PHP2Shell four days before public disclosure, according to an AWS security blog. The honeypot system MadPot logged activity from anonymized IP infrastructure on October 17. Multiple proof-of-concept codes appeared around 11:00 on October 21, and further attacks hit MadPot between 11:00 and 17:00. Amazon says different attack code and infrastructure suggest multiple attackers.
Amazon's honeypot, MadPot, was already receiving PHP2Shell exploit attempts on October 17, while the details were still under embargo. The vulnerabilities carry a severity rating of 9.2, and the emergency PHP update went out at 23:00 on October 21, moved up because related information leaked online before the patch.
After that deadline passed, PoC code had been seen around 11:00 the same day, and more attacks landed on MadPot between 11:00 and 17:00. The differing attack code and anonymization infrastructure lead Amazon to read the activity as more than one attacker, though it does not say whether they found the flaw themselves or obtained details through some route.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.