Amazon said its MadPot honeypots recorded an attempt to exploit the PHP2Shell vulnerabilities on 17 October, four days before the public announcement. The attempt came from an address on a commercial anonymisation network, and no successful compromise has been confirmed. CISA urged immediate updates to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, while PHP 8.1 and older need an upgrade. Finland temporarily shut government websites, and organisations such as the BBC took pages down until they could patch.

What it means: The new information changes the risk picture: if someone was already testing the exploit before the official announcement, administrators cannot assume they had a safe window. The right response is therefore not only to update PHP but also to look for signs of compromise in the days before the patch. The reaction of governments and large organisations, which preferred to take services offline, shows how seriously the issue is being treated. For Greek businesses, PHP runs behind many online shops on WooCommerce, Magento or OpenCart, company websites on WordPress and internal systems. Practical steps: inventory every server and container running PHP, upgrade and restart, rebuild images, check web logs for suspicious uploads and unknown processes, and rotate passwords and keys if there is any doubt. Anyone on hosted services should ask the provider for written confirmation that the update is done. Old, unsupported PHP versions are now an open door and upgrading them should not be postponed.

Read the original on AWS Security Blog

Related service: Custom software

Related stories