Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Security researchers discovered that hackers were actively exploiting critical PHP vulnerabilities days before the official patches were released. Amazon Web Services identified the activity on their honeypots, suggesting that threat actors may have had early access to exploit information.
Why it matters
This incident underscores the risks of 'zero-day' exploits and the critical importance of rapid patch deployment in global web infrastructure.
Wednesday’s release of fixes for two critical vulnerabilities in PHP caused administrators and security staff to race to identify and patch vulnerable websites and apps, while attackers inevitably reverse engineered the fixes to learn how to exploit the flaws. Some governments and other groups even proactively took key websites down in anticipation of the release, so they wouldn't be targeted before they could apply the patches.
But in addition to detecting such active exploitation on Wednesday, research published Wednesday evening by Amazon Web Services indicates that at least one actor had started attempting to exploit the bugs—known collectively as PHP2Shell—on October 17, four days before Wednesday's public revelations.
Headlinne story · 7 newsrooms
Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws
What every outlet reported, where they differ, and how each framed it →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in