网民周三疯狂地在PHP中修补一对关键弱点
周三发布针对PHP中两个关键弱点的解决方案，导致管理员和安保人员竞相识别并补齐弱势网站和应用程序，有些政府和其他团体甚至为了期待发布而主动将关键网站拿下，因此在应用补丁之前不会成为目标。
Amazon Web Services在10月17日，即周三公开揭发前四天，至少有一位演员开始尝试利用这些臭虫
AWS分析师在星期三看到10月17日的开采，同时回顾他们所谓的一个蜜罐上的活动，或者故意易受攻击的网络服务器或其他数字诱饵，帮助研究人员研究攻击方法和趋势。 尝试来自一个IP地址，即AWS 称与一个"商业匿名网络"相连，换句话说是一个代理网络或VPN.
“尽管脆弱性受到禁运，但从匿名IP地址中瞄准一个蜜罐表明，这一活动是由威胁行为者进行的，尽管仍然不清楚该行为者收购如何在披露之前利用信息，”AWS首席信息安全官员CJ Moses在研究文章中写道。
PHP2Shell的概念开发证据于星期三开始公开出现，有些似乎在ET上午10点公开披露前几个小时出现。 AWS研究人员说，在披露之前的几小时里，他们的蜜罐被多次利用各种供应商的开发尝试所击中，似乎有各种攻击目标，可能表明多个不同的行为者。 摩西写道，“技术分析正在进行之中，他补充说，“PHP2壳现在在野外被广泛开发。
PHP基金会没有立即回应WIRED的征求意见请求。
虽然尚不清楚10月17日的开采是怎样发生的，还是从何而来，但AWS强调，调查结果强调，鉴于AI工具可以加速脆弱性分析，使技术不熟练的行为者能够迅速开发新的开采，协调的脆弱性披露必须如何演变和加快全球获取这些工具的速度。
Moses写道：“从补丁到工作开发的时间由于结构原因正在缩短”。 “在过去，我们看到的大多数剥削是在公开证明概念为发布之后发生的。 少数有能力的演员建立了剥削，其他人也在等待。 这种依赖性正在减弱。 AI辅助分析使得将补丁diff或咨询转化为工作开发更便宜。 因此，一旦披露了脆弱性的技术细节，更多的行为者可以在数小时甚至数分钟内采取行动。”
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The internet’s mad scramble on Wednesday to patch a pair of critical vulnerabilities in PHP, a widely used web scripting language, was already too late to stop every attack, newly released details reveal.
Wednesday’s release of fixes for two critical vulnerabilities in PHP caused administrators and security staff to race to identify and patch vulnerable websites and apps, while attackers inevitably reverse engineered the fixes to learn how to exploit the flaws. Some governments and other groups even proactively took key websites down in anticipation of the release, so they wouldn't be targeted before they could apply the patches.
But in addition to detecting such active exploitation on Wednesday, research published Wednesday evening by Amazon Web Services indicates that at least one actor had started attempting to exploit the bugs—known collectively as PHP2Shell—on October 17, four days before Wednesday's public revelations.
AWS analysts spotted the October 17 exploitation on Wednesday while looking back at activity on one of their so-called honeypots, or intentionally vulnerable web servers or other digital lures that help researchers study attack methods and trends. The attempt came from an IP address that AWS says is linked to a “commercial anonymization network,” in other words a proxy network or VPN.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” CJ Moses, AWS's chief information security officer, wrote in the research post.
Proof-of-concept exploits for PHP2Shell began emerging publicly on Wednesday, with some seeming to appear hours before the public disclosure at 10 am ET. In the hours leading up to the disclosure, AWS researchers say their honeypots were hit with multiple exploitation attempts anonymized using various providers and seemingly with various attack goals, likely indicating multiple different actors. “Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems,” Moses wrote. He added that “PHP2Shell is now being broadly exploited in the wild.”
The PHP Foundation did not immediately respond to WIRED's request for comment.
Though it is unclear how the exploitation on October 17 happened or where it came from, AWS emphasizes that the findings underscore how coordinated vulnerability disclosure must evolve and speed up given global access to AI tools that can accelerate vulnerability analysis and allow less technically proficient actors to quickly develop new exploits.
“The time from patch to working exploit is shrinking for structural reasons,” Moses wrote. “In the past, most exploitation we observed came after a public proof of concept was released. A small number of capable actors built exploits, and everyone else waited for them. That dependency is weakening. AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. As a result, more actors can act within hours or even minutes once technical details of a vulnerability are disclosed.”
Auto-fetched and translated by AI Atlas. All rights belong to the original author.