Widespread Exploitation of PHP2Shell Flaw Detected After AWS Logs Show Early Probing

Security researchers have confirmed that the critical PHP2Shell vulnerability, which allows remote code execution on vulnerable servers, began seeing active exploitation across the internet shortly after Amazon Web Services (AWS) recorded probing attempts four days ago.

According to logs obtained from AWS, automated scans targeting the PHP2Shell bug were observed on the platform's infrastructure before the official patches were released. The timing suggests that threat actors were monitoring the vulnerability and prepared to launch attacks as soon as the flaw became publicly known.

The PHP2Shell issue, sometimes referred to as a "PHP2Shell" bug, stems from a flaw in certain PHP configurations that can be abused to execute arbitrary commands on a server. While the vulnerability has been known to the security community for several months, a recent set of patches issued by the PHP development team aimed to close the most exploitable paths. The rapid transition from detection to “broadly exploited” status highlights how quickly attackers can move from reconnaissance to active intrusion when a high‑impact flaw is disclosed.

Industry analysts note that the AWS observations are a reminder of the importance of continuous monitoring, especially for cloud providers that host a large share of web applications. By capturing early attempts, AWS was able to alert its customers and share indicators of compromise with the broader security ecosystem, enabling some organizations to apply mitigations before the wave of attacks fully materialized.

Organizations running PHP‑based sites are now urged to verify that they have applied the latest security updates and to review their server configurations for any remnants of vulnerable settings. In addition, experts recommend employing web‑application firewalls, strict input validation, and regular vulnerability scanning to reduce the attack surface for similar exploits.

The episode underscores a broader trend in cybersecurity: as software supply chains become more complex, the window between vulnerability disclosure and active exploitation continues to shrink. Observers expect that the heightened attention on PHP2Shell will prompt both developers and operators to prioritize timely patching and to adopt more proactive threat‑intelligence sharing practices to stay ahead of future attacks.