PHP2Shell Flaw Exploited Before Disclosure: What Happened After October's Critical Bugs

Between 16 and 23 October, five major security incidents became public: two remote code execution bugs in PHP, a memory corruption bug in Google's Brotli decoder, a chain of four bugs in Plex Media Server, a maximum-severity (CVSS 10.0) bug in GitLab, and eight compromised certificate authority keys at eMudhra. Hacktron's follow-up looks at what happened next, and the PHP flaws, known as PHP2Shell, stand out.

PHP fixed the bugs on 21 October in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon Threat Intelligence recorded an exploitation attempt on 17 October, four days before disclosure, and says it is unclear how the attacker obtained the details so early. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 26 October. Palo Alto Networks reports active exploitation against PAN-OS management interfaces exposed to the internet. Dream Research described a campaign that chained PHP2Shell with a Linux kernel privilege-escalation bug and compromised 24 firewalls in the US, Japan, Taiwan and South Korea, two of them belonging to a US government-affiliated organisation. Unit 42 says it verified the attacker's tooling and results.

The picture is nuanced. PHP2Shell is a blind memory corruption bug, so an exploit usually has to be tuned to each target. Attempts are widespread, but confirmed successful compromises are rarer, and Wiz says it has not seen a successful end-to-end exploit in its own data. Hacktron found that frontier AI models adapted the exploit to a new target in hours, while the open models it tested did not, and it expects that gap to narrow.