Someone was already testing an attack on the two critical PHP flaws known as PHP2Shell on Oct. 17, four days before fixes were released, Amazon said in research reported by SecurityWeek Thursday. Separately, Palo Alto Networks said every supported version of its firewall operating system is affected and has no fix date. For organizations, that means the exposure window opened before the patch, and some vulnerable PHP sits inside security equipment that customers cannot update themselves.
The fixes shipped Wednesday, The Primary Wire reported. What is new: the threat started earlier and now reaches network gear.
What Happened
Amazon runs MadPot, a network of honeypots, which are decoy systems built to attract attackers. In a blog post, Amazon Chief Information Security Officer CJ Moses wrote that the Oct. 17 attempt came from a commercial anonymization network and that it is unclear how the actor obtained exploit details while the bugs were still under embargo, the period when flaws are kept secret while fixes are prepared. Between about 2 a.m. and 8 a.m. UTC on Oct. 21, hours before the 2 p.m. UTC release, more attempts arrived from other anonymized infrastructure with varied payloads, suggesting several actors. Amazon says PHP2Shell "is now being broadly exploited in the wild."
Attempts are not the same as successful break-ins. Cloudflare Chief Executive Matthew Prince said attempts went from thousands in the 10 hours before disclosure to millions by early Thursday, SecurityWeek reported. Yet watchTowr's head of threat intelligence, Jake Knott, said none of the circulating proof-of-concept exploits achieved remote code execution. The Cybersecurity and Infrastructure Security Agency (CISA) said in its Oct. 21 alert that it had not observed exploitation at publication. No confirmed compromise has been reported.
Palo Alto's advisory lists all versions of PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2, and all versions of Panorama, its central management console, as affected through the management web interface and XML API. Fixes are "upcoming" with no date. The company rates the issue high, says risk is greatest when the management interface is reachable from the internet and knows of no malicious exploitation against its products. GlobalProtect portals and gateways, Prisma Access and Cloud NGFW are not affected. Interim steps include enabling specific Threat Prevention signatures and limiting management access to trusted internal addresses.
Cisco's advisory, rated critical, lists products under investigation, among them Identity Services Engine, Catalyst Center, Catalyst SD-WAN Manager, Expressway and Webex, but none confirmed vulnerable and no workarounds. Fortinet's advisory scores the flaws 9.8 out of 10, is investigating FortiADC, FortiSIEM, FortiSOAR and others, and says FortiOS, FortiManager, FortiAnalyzer and FortiWeb are not affected.
Sites Taken Offline
Governments and companies pulled services as a precaution, according to a Reuters factbox. They included Germany's federal IT provider ITZBund, French prefecture websites, Finland's state IT center Valtori, the Port of Rotterdam and Japan's Ministry of Finance. Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway suspended some internet services. The BBC took some web portals down, and the Wikimedia Foundation took several systems down. Germany said no incidents were known, and Valtori said it found no exploitation attempts.
The Embargo Dispute
The PHP Foundation said Chainguard published built images containing the fix at 7:41 a.m. UTC Oct. 21, more than six hours early, and "unilaterally broke the embargo." Chainguard Chief Executive Dan Lorenc told The Register the company did not leak the bugs, found them independently with an AI model and shipped fixes once people were being attacked. Amazon's first sighting predates that release.
Why It Matters
Patch dates no longer bound the risk. Amazon advises starting investigations no later than Oct. 17 and measuring patch timelines for critical internet-facing flaws in hours, not seven or 30 days. Censys counted about 1.57 million internet-facing hosts on unpatched PHP versions Oct. 21, and VulnCheck counted at least 1 million on end-of-life versions that receive no official fix, SecurityWeek reported.
For boards, the harder problem is PHP inside products. When it runs in a firewall's management console, customers depend on the vendor's schedule. Leaders should ask which appliances embed PHP, whether their management interfaces face the internet and what interim protections are in place.
What to Watch
- Fixed PAN-OS and Panorama releases from Palo Alto.
- Results of the Cisco and Fortinet investigations.
- Whether any attempt becomes a confirmed compromise, and whether CISA adds the flaws to its Known Exploited Vulnerabilities catalog.
