AWS researchers detected attempts targeting two PHP security flaws on Oct.

17; official fixes were released on Oct.

21.

Known together as PHP2Shell, the flaws are now reportedly being widely used in real attacks, according to AWS.

The account also examines the unclear path by which attackers learned about them before public disclosure and AWS’s finding that AI may be speeding up attack creation from software updates.

Attack attempts before public disclosure

AWS researchers detected the first attempts at decoy systems they had set up to monitor attacks. The activity came from an internet address connected to an anonymization network.

It is unclear how the attackers learned of the vulnerabilities before they were publicly disclosed. Since the public disclosure, several more attack attempts have been identified by different attackers.…