GoKawiilAmazon says hackers exploited PHP flaws days before public disclosure
Amazon reported it detected hackers attempting to exploit two vulnerabilities in the PHP programming language four days before the flaws were publicly disclosed, and said exploitation is now widespread. The US NSA and UK authorities separately warned organizations running PHP to patch immediately or take systems offline, and PHP's maintainers have released fixes. The bugs reportedly went undetected for more than a decade and were found with help from OpenAI and Google AI models.
GoKawiil's interpretation of the reporting above, not reported fact.
The episode suggests AI tools can surface long-hidden software flaws, which could help defenders but also hands attackers a head start if they find such bugs first, as appears to have happened here. It adds weight to earlier warnings from politicians and regulators about the cyber risks posed by advanced AI models, which led US authorities to temporarily restrict their release. Because PHP underlies a huge share of websites, unpatched systems could remain vulnerable for some time even after fixes are available.
- Amazon detected active exploitation of PHP vulnerabilities four days before public disclosure.
- NSA and UK authorities urged organizations to patch PHP immediately or take affected systems offline.
- The flaws, undetected for over a decade, were uncovered with help from OpenAI and Google AI models.
YubiKey 5C NFC Security Key — With critical server-side vulnerabilities being actively exploited, hardening account access with hardware-based authentication is a smart defensive layer. A YubiKey adds phishing-resistant two-factor protection to admin and developer accounts that attackers often target first after a breach.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-10-22
Published there as: “Hackers got a four-day head start on epic PHP2Shell vulnerability”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.