What changed
On Wednesday, the PHP Foundation released critical security patches for two vulnerabilities, prompting administrators to rush to secure their systems. However, newly released research by Amazon Web Services (AWS) reveals that attackers had already begun exploiting these flaws as early as October 17, four days before the patches were made public.
What this means in practice
AWS analysts discovered the October 17 exploitation while reviewing activity on a honeypot, an intentionally vulnerable system used to study attack patterns. The attack originated from an IP address linked to a commercial anonymization network, suggesting the use of a proxy or VPN. This indicates that threat actors were able to access exploit details before the official disclosure, likely through leaked information or reverse engineering.
Limitations and availability
The PHP Foundation did not immediately comment on the findings. While the exact methods or sources of the October 17 attack remain unclear, AWS emphasizes that the incident highlights the growing speed at which vulnerabilities are being exploited. The research underscores the need for faster and more coordinated vulnerability disclosure processes, especially with the increasing use of AI tools that can rapidly turn patch details into working exploits. The findings do not specify how the attackers obtained the exploit information prior to the public disclosure.
