AWS caught PHP2Shell exploitation four days before disclosure and publishes WAF mitigations

The two AWS security posts tell one story. PHP2Shell is a pair of unauthenticated remote code execution bugs in the PHP core runtime, which runs an estimated 70% of websites. AWS's MadPot honeypot fleet saw exploitation on October 17, while the vulnerabilities were still embargoed. That strongly suggests a leak, or independent discovery by an attacker, before coordinated disclosure.

The mitigation post explains how to apply AWS WAF rules that block known exploit patterns. It is a stopgap for teams that cannot immediately redeploy patched PHP runtimes across fleets.

The AI angle is that discovery itself was AI-assisted. OpenAI says its models found the flaws through its 'Patch the Planet' coalition, and Wiz's write-up, 'AI uncovers critical RCE in PHP,' drew 434 HN points. Pre-disclosure exploitation is the uncomfortable flip side: if AI speeds up finding bugs, the embargo window becomes the weakest link.

Watch for broader exploitation now that the bugs are public, for confirmation of how the attacker learned about them early, and for whether coordinated-disclosure norms change when AI is doing the discovering.