The internet’s mad scramble on Wednesday to patch a pair of critical vulnerabilities in PHP , a widely used web scripting language, was already too late to stop every attack, newly released details reveal.

Wednesday’s release of fixes for two critical vulnerabilities in PHP caused administrators and security staff to race to identify and patch vulnerable websites and apps, while attackers inevitably reverse engineered the fixes to learn how to exploit the flaws. Some governments and other groups even proactively took key websites down in anticipation of the release, so they wouldn't be targeted before they could apply the patches.

But in addition to detecting such active exploitation on Wednesday, research published Wednesday evening by Amazon Web Services indicates that at least one actor had started attempting to exploit the bugs—known collectively as PHP2Shell—on October 17, four days before Wednesday's public revelations.

AWS analysts spotted the October 17 exploitation on Wednesday while looking back…