Amazon says PHP2Shell exploitation began 4 days before patches
-
Researchers at Amazon Threat Intelligence report that attackers started exploiting the PHP2Shell vulnerabilities four days before patches for the flaws became available on Wednesday. The exploitation activity predates the public fix, indicating that threat actors were already active against vulnerable systems while defenders had no vendor patch to apply.
At this stage, the source material does not provide specific identifiers, affected version lists, or indicators of compromise beyond the exploitation timeline, so details beyond what has been published should be treated cautiously. Organizations running PHP-based services should prioritize reviewing their exposure and apply the vendor patches as soon as possible, while monitoring for signs of compromise that may date back to the pre-patch exploitation window.
Given that attacks began before fixes existed, a patching-only response may not be sufficient. Teams should also review logs from the days preceding the patch release and consider whether any suspicious activity occurred during that period.
Source: Unknown
Has your organization checked for signs of PHP2Shell exploitation dating back to before the patches were released?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login