Amazon Threat Intelligence said its MadPot honeypot observed attempts to exploit two PHP2Shell vulnerabilities four days before related details were publicly disclosed, BlockBeats’ Beating AI bulletin reported on Oct. 22.
Amazon says exploitation began before disclosure
The two PHP2Shell flaws can let unauthenticated attackers run code and affect PHP 7.x and 8.x, according to the report. Amazon said the activity came from IP addresses associated with commercial anonymity networks and that it had not confirmed how the attackers obtained attack information during the embargo period.
Amazon said proof-of-concept samples appeared within hours of patches and public information being released, followed by probing from multiple actors using different anonymous infrastructure. Its account described PHP2Shell as broadly used in the wild, while also saying it had not confirmed that a real system was compromised. Amazon chief information security officer CJ Moses said AI-assisted analysis is lowering the cost of turning patch differences or advisories into usable attack code.