AWS analysts claim that at least one actor started to exploit the PHP2Shell bugs on October 17, four days prior to the vulnerabilities' public disclosure

The window between vulnerability disclosure and active exploitation has collapsed, meaning systems are now at immediate risk the moment a patch is released.

Amazon Web Services (AWS) researchers have identified evidence of exploitation of critical PHP vulnerabilities, collectively known as PHP2Shell, dating back to October 17, four days before the official public disclosure and release of patches. This exploitation attempt was detected on an AWS honeypot, an intentionally vulnerable server used for security research, originating from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the nature of the attack suggests a sophisticated threat actor, though the method of acquiring exploit information prior to disclosure remains unclear. AWS noted that multiple, varied exploitation attempts, also anonymized, targeted their honeypots in the hours leading up to the public disclosure, indicating potential activity from several different actors. Since the public release of fixes, the PHP2Shell vulnerabilities are now being broadly exploited in the wild, prompting security teams to scramble to patch affected systems.

The discovery highlights a concerning acceleration in the exploit development lifecycle, directly linked to the increasing accessibility and power of AI tools. Threat actors can now bypass traditional cycles where exploits followed public proof-of-concepts, enabling them to generate functional exploits rapidly from patch diffs or advisories. This democratizes exploit creation, lowering the barrier to entry for less technically skilled individuals and increasing the overall threat landscape.

This evolving threat dynamic necessitates a fundamental shift in coordinated vulnerability disclosure practices. Organizations must anticipate that exploits may be available and actively used by malicious actors almost immediately after patches are issued, if not sooner. The emphasis will likely move towards proactive threat hunting and rapid, automated patching to mitigate risk in this compressed timeline.