When the PHP project released fixes for the PHP2Shell flaws on October 21, most teams treated it as the starting gun. It turns out at least one attacker had a head start. In research published by Amazon Web Services, the company says one of its honeypots, a deliberately exposed decoy server, was hit with an attempt to exploit the bugs on October 17, while the details were still under embargo.
WIRED’s report adds context: the attempt came through an anonymizing network, and AWS says it’s unclear how the attacker got the details early. In the hours before the official disclosure, AWS’s decoys saw several more attempts from different sources, suggesting multiple groups. The PHP Foundation told WIRED it agrees upgrading is essential but that, to its knowledge, no remote code execution attempt had succeeded.
What changed
AWS’s chief information security officer, CJ Moses, makes the structural point in the post: exploitation used to wait for a public proof of concept written by a few skilled people. AI-assisted analysis now makes it cheaper to turn a patch or advisory into a working exploit, so more attackers can move within hours or minutes.
For defenders, that turns a familiar assumption on its head. “We have a few days after the advisory” is no longer a safe plan.
Field notes for your team
- Treat advance notices as action items. PHP warned of the fixes a day early. Use that window to inventory affected systems and pre-stage updates, so patching is a deploy rather than a project.
- Shrink your patch path. Know who can approve an emergency change after hours, and practice it. If an update needs three meetings, it’s too slow for this kind of bug.
- Decide your “pull the plug” rule in advance. Some governments took sites offline before the release. Agree now which systems you’d take down and who makes the call.
- Look back, not just forward. AWS found the October 17 attempt by reviewing older honeypot data. After any critical disclosure, search your logs for the days before it, not only after.
- Keep logs long enough to matter. If you only keep 72 hours of web logs, you can’t answer “were we hit before the patch?”
- Watch anonymized traffic. Both the early attempt and later probes came through proxy or VPN networks. Extra alerting on unusual requests from those ranges is cheap insurance.
The takeaway
The PHP2Shell timeline is a preview of how big vulnerabilities will play out from now on: less warning, faster exploits, more attackers. Your response plan should assume the clock started before the advisory did.
Based on reporting by WIRED and AWS Security.
