Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

hyperpape

There's also a tweet by Matthew Prince that says Cloudflare saw thousands of attempts pre-announcement, https://x.com/eastdakota/status/2113079352682570051 , then tens of thousands post announcement, and now millions. Unfortunately, if you read the announcement as referring to 14:00 UTC, that's several hours after Chainguard published their images. I don't know if it's plausible that people saw the Chainguard builds, understood the issue from those and built exploits, but a precise timeline would help understand better.

VladVladikoff

I’ve seen probing for it in server logs but not actual exploiting of it. I think the botnets added it to their vulnerability scanners but I have yet to see any examples of an actual working exploit. There are hundreds of vibe coded attempts on github but none of them work to the best of my knowledge. Would love someone to prove me wrong here. Also this post from Amazon is embarrassing. They knew about it from the 17th yet failed to meet the embargo timeline and patch Amazon Linux (their patch is due to be released today the 22nd of Oct).

bcvvvy

Why haven’t they fixed Amazon Linux then? Same as none of their AMIs for bottlerocket have emSign revocations. Absolutely shit company who puts their customers at risk.

menomatter

Do they differentiate between attempts and successful infiltration? I’m trying to understand whether this exploit is easy to use or not. There was an article here from yesterday that argued the exploit was not easy to use and needed LFI

Tomdarkness

So Amazon knew about this exploit and that it was actively being used several days before the release of any patches. Despite this they still took 18 hours AFTER the release of the patches to provide updated version of their Amazon Linux packages? https://github.com/amazonlinux/amazon-linux-2023/issues/1148 I don't think this blog post is sending the message AWS intended...

ActionHank

All these tech companies are school children comparing how much better their bike is than the others, but they've all got the exact same bike, and that bike is a massive vulnerability that they did nothing to fix, but they're all bragging about how they saw it first or identified it first. To the person at amazon that thought this was a good press release to put out, I know this is what you were hoping for, so here it is, "wow, so cool". Not sure why, but AI really has everyone running around with desperate loser aura. Maybe next time, do better, actually patch some things so your customers are covered?

makmanalp

Take a peek at my detailed full-ish timeline of every actor around the embargo and leak, just added amazon's reporting in there as well: https://news.ycombinator.com/item?id=50190603

bzmrgonz

What did crowdsec see? Anybody know? Php exploits should be on a fast track of alerting, given the wide installation base.

andyvanosdale

If this was being probed and/or exploited on October 17th, this throws shade on the PHP team for throwing shade on Chainguard in their public announcement. Essentially, the PHP team is deflecting and abdicating their responsibilities in all this mess they created. "Chainguard broke embargo", "support us with money", "we are just volunteers", "we had knowledge years ago but no POC because we wanted to ship features and not security fixes". All just deflections. This fiasco shows me that I would never use PHP for any project I'm part of. The PHP team royally messed up, and they are deflecting the blame left, right, up, and down.

paxy

It's pretty telling that the attacks started after the vulnerability was found by researchers and PHP insiders notified. Who really believes that a malicious entity found the exact same exploit chain at the same time fully independently? The PHP foundation needs to give a better answer for why they were asleep at the wheel for 2+ months while insiders were sharing/selling the info.

hannob

I wish people who report "exploitation attempts" would be very clear about what they actually observed. Something that would lead to an uncontrolled memory corruption, potentially leading to a crash, or something that indicates a real, code-executing exploit? Those two kinds events are of very different significance. I can't read from Amazon's announcement which one they think they saw.

cookiengineer

Shameless self promo for all the naysayers that are deflecting: https://news.ycombinator.com/item?id=50195017

decidu0us9034

"Exploitation attempt" lacks clarity. The bot scanners are constantly generating huge volumes of weird traffic. Does anyone have a portable, reliable exploit that works in real heterogeneous conditions and not a lab setup, and is that even feasible? doesn't seem like it. llms automate development of practical exploits but don't remove every constraint that makes them hard to begin with. it feels like people are missing this, idk

system2

PHP is dead to me. Countless WordPress and Magento hacks, countless lost customers because of these issues. I am done, and I will spread the hate with passion. I wish I had never learnt this garbage and spent more time with Python and C.

kyledrake

I had a huge spike in PHP hacking attempts on the 20th, the day before the announcements. It was substantial enough that it was almost a DDoS attack and I had to mitigate it. Curiously, all of the requests were coming from Cloudflare-controlled IP addresses (Workers? VPN? Internal server?). This of course means that these attempts would succeed for anyone that was whitelisting Cloudflare IPs but blocking others. I tried to get this information over to them, but their abuse contact form does not allow you to submit unless you have a non-IP domain URL as evidence, which I didn't have because it's just source IPs. Suffice to say if you are behind Cloudflare and think whitelisting only their IPs is protecting you, think again.