Amazon Detects Large-Scale PHP Exploit Activity Days Before Public Disclosure

Amazon Web Services' security team reported that it identified attempts to exploit a pair of critical PHP vulnerabilities a full four days before those flaws were publicly disclosed, marking one of the earliest known pre‑disclosure attacks on the popular scripting language.

The incidents, dubbed "PHP2Shell" by researchers, involved malicious actors probing web servers for the weaknesses and attempting to execute arbitrary commands. Threat‑intelligence analysts monitoring the activity say the scale of the attempts suggests coordinated exploitation, with thousands of IP addresses targeting vulnerable hosts across multiple regions.

PHP remains a cornerstone of web development, powering a substantial portion of the internet's dynamic sites and applications. Because the language is embedded in countless content management systems, e‑commerce platforms and custom codebases, any serious flaw can have far‑reaching consequences. The two vulnerabilities in question allow attackers to bypass typical security controls and gain shell access, potentially leading to data theft, defacement or further compromise of internal networks.

Security researchers first became aware of the exploit attempts after Amazon's automated detection systems flagged anomalous traffic patterns consistent with known PHP exploitation techniques. The findings were later corroborated by independent threat‑intel firms, which observed similar activity in their own monitoring feeds. By the time the vulnerabilities were formally disclosed, the window of pre‑release exploitation had already closed, but the evidence underscores how quickly threat actors can act on leaked or otherwise obtained information.

Industry experts note that the early detection highlights both the value of large cloud providers' telemetry and the challenges of protecting legacy code. Organizations running PHP applications are urged to apply patches promptly, review their exposure through asset inventories, and consider additional layers such as web‑application firewalls and runtime application self‑protection (RASP) tools.

Looking ahead, the incident may prompt a reassessment of disclosure timelines and coordination between vendors, researchers and cloud platforms. While no widespread damage has been reported so far, the episode serves as a reminder that even well‑known technologies can harbor high‑impact flaws, and that vigilance across the supply chain remains essential to mitigate emerging threats.