Hackers began looking for servers to target and trying to exploit two critical vulnerabilities found in the PHP programming language four days before they were patched, SecurityWeek reported on Oct. 22, citing Amazon.

The report said the two flaws, known as PHP2Shell, could be abused to let attackers remotely control servers.

The PHP Foundation and industry partners distributed the patch on Oct. 21 after creating and verifying it over several weeks. But exploit code also spread quickly after vulnerability details leaked online on Oct. 20.

Amazon said the first attack attempt came from an anonymising network on Oct. 17, when the vulnerabilities had not yet been disclosed. It said multiple exploit codes were found on other anonymous infrastructure about 12 hours before disclosure. Amazon believes several hackers joined the attacks.

Amazon said, "More exploit code emerged within hours of the patch release, and PHP2Shell is now being widely exploited."

Cloudflare CEO Matthew Prince (매슈 프린스) said there were thousands of attack attempts in the 10 hours before the disclosure. He said they rose to tens of thousands 45 minutes after disclosure, hundreds of thousands within two hours, and now millions. Security firm WatchTowr said most of the circulating exploit code does not work or is only capable of taking down target servers.

Many servers are still believed to be unpatched. Censys estimated that about 1,570,000 PHP hosts connected to the internet had not been patched as of Oct. 21. VulnCheck said at least 1,000,000 hosts were also running older versions of PHP that are no longer supported.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommended on Oct. 21 updating immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Experts are also comparing PHP2Shell with Log4Shell, a Log4j library vulnerability. Sai Molige (사이 몰리게), a manager at Forescout, said, "It could become a Log4Shell-scale incident." He said it was hard to find where Log4Shell was used, and that even when abandoned servers using PHP are identified, they are often on versions that can no longer receive official patches because support has ended.