PHP2Shell Flaws Were Exploited Days Before Patches, AWS Logs Show

Attacks began before the patch

According to Amazon Web Services logs, attempts to leverage the critical PHP vulnerabilities known as PHP2Shell were seen four days before the official patches landed. That shows attackers were actively using the gap between disclosure and remediation.

Now broadly exploited

Wired reports the flaws are now being "broadly exploited" across the internet. Because PHP underpins a large share of websites and server-side applications, the impact reaches millions of systems.

Why it matters

PHP2Shell covers flaws that allow remote code execution (RCE). Such bugs can let an attacker run their own commands on a server, effectively taking it over. Pre-patch exploitation means vulnerable systems were targeted before defenders had a fix in hand.

What to do

Administrators running PHP should apply patches without delay, review access logs and watch for suspicious requests. Combined with earlier reporting that the flaws had been known for years and that the patch process turned into a crisis, this incident puts patch discipline front and center.