PHP2Shell flaws were reportedly probed four days before public disclosure

An exploitation attempt observed four days before disclosure

Amazon said it identified an attempt to exploit the PHP vulnerabilities four days before they were disclosed publicly. It also said the flaws were being broadly exploited. PHP maintainers released patches, and the NSA advised organizations using PHP to update immediately or take systems offline if an immediate update was not feasible.

The report says Amazon identified an attempted exploit four days before the vulnerabilities were publicly disclosed; it does not provide a comparable earlier measure of exploitation.

PHP maintainers released updates for the two vulnerabilities, while Amazon said it had identified pre-disclosure probing and that the flaws were being broadly exploited.

The reported pre-disclosure probing means defenders may have had less time to respond before learning of the vulnerabilities. The article describes PHP as widely used for websites, while the reported exploitation and scope remain unverified.