Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.
The vulnerabilities, in PHP’s core code, allow attackers to execute arbitrary code on servers running the popular web scripting language. Security researchers discovered the bugs last week, and PHP developers quickly released patches. But the window between discovery and fix was enough for attackers to start probing for vulnerable systems.
AWS, in an advisory to its customers, said it detected the exploitation attempts starting on November 28th. “We observed attackers attempting to exploit the vulnerabilities approximately four days before the availability of public patches,” the advisory reads. “These attacks are now being broadly exploited across the internet.”
The PHP2Shell vulnerabilities stem from how PHP handles external entities in XML documents. An attacker can craft a malicious XML file that, when processed by a vulnerable PHP application, allows them to execute code on the server. The vulnerabilities affect PHP versions 8.1, 8.2, and 8.3.
“The exploitation attempts we observed involved sending crafted HTTP requests to web servers in an attempt to trigger the vulnerabilities,” AWS said. “We recommend that all customers immediately apply the available patches to their PHP installations.”
The news comes as security experts warn of a surge in attacks targeting PHP vulnerabilities. Last month, a critical remote code execution vulnerability was discovered in the popular WordPress plugin WPForms, which affected millions of websites.