亚马逊威胁情报在2026年10月17日发现了PHP2Shell漏洞的利用尝试，比公开披露时间提前四天1。该漏洞（CVE-2026-109618和CVE-2026-109619）于10月21日14:00 UTC公开1，其影响范围覆盖互联网70%的网站2。漏洞公开仅12小时后，首个概念验证代码即已出现1，随后在全球范围内引发数百万次黑客攻击尝试2。
这一事件反映了威胁形势的加速演变。亚马逊的分析基于超过2000亿条每分钟事件的监测1，表明威胁行为者在补丁发布前已掌握漏洞信息1。美国NSA随即发出警告2，促使包括MSUFCU等金融机构暂停电子银行服务2。
亚马逊建议关键漏洞的补丁部署时间表应以小时计，而非传统的7天或30天服务级别协议1。这一建议反映了一个更深层的趋势：从补丁发布到可用漏洞的时间窗口已从数周缩短至数小时或数分钟1。
Amazon's threat intelligence team identified exploitation attempts targeting the PHP2Shell vulnerability on October 17, 2026, four days prior to its official disclosure.1 The vulnerability, identified as CVE-2026-109618 and CVE-2026-109619, was publicly revealed on October 21, 2026 at 14:00 UTC.1 However, the first proof-of-concept code emerged at 02:00 UTC on October 21—twelve hours before public disclosure—indicating that threat actors possessed knowledge of the flaw before patches were available.1 The vulnerability enables remote code execution and affects approximately 70 percent of internet websites globally.12
Following disclosure, exploitation attempts intensified rapidly.2 Millions of hacking attempts occurred as organizations worldwide rushed to deploy patches and secure their systems.2 The U.S. National Security Agency issued a warning in response to the threat.2 Amazon's analysis, which processed over 200 billion events per minute, revealed that the window from patch release to active exploitation has compressed from weeks to hours or minutes.1
Amazon's threat researchers recommend that patch deployment timelines for critical vulnerabilities should be measured in hours rather than the traditional 7 or 30-day service level agreements.1
评论
还没有评论，欢迎留下第一条。