Hackers got a four-day head start on epic PHP2Shell vulnerability

Amazon reported that hackers attempted to exploit the PHP2Shell vulnerabilities four days before public disclosure, and said the flaws are "now being broadly exploited in the wild." The US National Security Agency and UK authorities warned on Wednesday that the two PHP vulnerabilities, which were uncovered with the help of OpenAI and Google models after going undetected for more than a decade, left websites worldwide critically exposed, and PHP maintainers released software updates to patch them the same day. The NSA urged all organizations using PHP to immediately update their systems or take them offline.

Amazon has warned that vulnerabilities in a programming language https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/ that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems. The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were “now being broadly exploited in the wild.” The US National Security Agency and UK authorities earlier on Wednesday warned that the vulnerabilities had left websites around the world critically exposed to hacking, as some governments in Europe were reportedly taking sites offline while they patched the two security flaws. The vast impact of the bugs, uncovered with the help of OpenAI and Google models after being undetected for more than a decade, highlights the ability of AI to upend cybersecurity. The release of new models earlier this year from Anthropic and OpenAI with powerful cyber capabilities prompted warnings from politicians and financial regulators and led the US government to temporarily limit their rollout. The NSA on Wednesday warned all organizations using the programming language known as PHP to immediately update their systems or take them offline. The developers responsible for maintaining PHP released software updates to patch the vulnerabilities earlier on Wednesday.