PHP2Shell Attacks Began Before Public Disclosure, Raising Concerns About AI-Assisted Exploitation

The recent disclosure of the “PHP2Shell” PHP vulnerabilities took place with no small amount of drama, mostly owed to a chain of leaks that unfolded a day before the scheduled release. But the truly concerning element has been more quietly reported by the Amazon Threat Intelligence team. Their researchers say that threat actors were trying assorted attacks on these vulnerabilities at their honeypots at least four days prior to disclosure (and three days prior to the leaks beginning).

There are a few possible explanations, and an earlier leak by a malicious actor is certainly one. Amazon believes multiple different threat actors were making these attempts, however. What that might also point to is AI hitting upon the vulnerabilities ahead of disclosure. The researchers are warning that this must now be taken as a serious possibility, and that date of disclosure cannot be assumed to be the first date of exploitation in the wild.

Did AI find PHP vulnerabilities before disclosure?

PHP2Shell is one of the biggest disclosures in years, as it threatens an estimated 70% of the entire internet via PHP vulnerabilities in the core runtime engine dating back to versions released in 2012. It is also a relatively simple attack to pull off, essentially just a matter of lobbing a malicious HTTP request at a server. It also remains problematic in that only the currently supported PHP versions (8.2 to 8.5) are patched; many servers run an older version for which there is no complete alternate remediation.

In addition to the possibility of AI beating researchers to the punch in disclosure, especially in complex cases that require careful embargo handling such as these two PHP vulnerabilities, it is also very likely already helping attackers exploit known vulnerabilities much more quickly. In the past there was a fairly standard lifespan post-disclosure; a smaller number of the best and most prepared attackers would exploit it in days or weeks, with a larger group of less sophisticated attackers joining over a period of weeks to months. As the Amazon researchers note, that expected timeframe now has to be adjusted for AI assistance: threat actors will run exploits in minutes to hours after disclosure, as evidenced by millions of attempts already rolling in almost immediately after the leaks prompted the early release of proof of concept attacks.

PHP vulnerabilities likely to be a long-term headache

AI involvement in sussing out the PHP vulnerabilities is still speculative, and likely will remain so until more is known about the early attackers. What is certain is that there are estimated to be at least a million servers out there across the world running unsupported PHP versions, and AI will make it trivial to sniff them out.

As the Amazon researchers note, this also may be the point at which detection methods that require a signature for a specific CVE become obsolete. The Amazon report provides some partial remediations for organizations that have legacy servers that cannot be updated, but caution that installing PHP 8.2 or higher is the only complete protection against the vulnerabilities.