Attackers began exploiting critical PHP vulnerabilities days before official patches became available. Amazon Web Services detected attempts to leverage the flaws four days prior to disclosure.
The bugs, dubbed PHP2Shell, allow remote code execution on affected servers. Security researchers warn they are now being broadly exploited across the internet.
The vulnerabilities affect multiple versions of PHP, a scripting language powering most websites. Unpatched systems remain at significant risk of compromise.
AWS logged the early exploitation attempts through its threat intelligence systems. The activity suggests attackers had advance knowledge of the flaws before public disclosure.
Organizations running vulnerable PHP versions should apply patches immediately. Delayed updates leave servers exposed to active scanning and exploitation campaigns.
The rapid exploitation timeline highlights a growing trend of attackers reverse-engineering patches quickly. Defenders face shrinking windows to secure systems after fixes are released.
Administrators should monitor for indicators of compromise and review server logs. Patching remains the most effective defense against these actively exploited vulnerabilities.
