Hackers Exploited PHP2Shell 4 Days Before Disclosure as AWS Warns Attacks Are Broadening
Updated
Updated · WIRED · Oct 22
Hackers Exploited PHP2Shell 4 Days Before Disclosure as AWS Warns Attacks Are Broadening
3 articles · Updated · WIRED · Oct 22
Summary
AWS found at least one actor probing the critical PHP2Shell flaws on Oct. 17—four days before the bugs were publicly disclosed and patched on Wednesday.
Honeypot data showed the early attempt came from an IP tied to a commercial anonymization network, suggesting a threat actor had exploit knowledge while the vulnerabilities were still under embargo.
Multiple exploitation attempts then hit AWS honeypots in the hours before the 10 a.m. ET disclosure, and proof-of-concept code began appearing publicly around the same time.
AWS said it is still unclear whether the observed attempts would have succeeded on real systems, but warned PHP2Shell is now being broadly exploited in the wild.
The findings add pressure to speed coordinated vulnerability disclosure, with AWS arguing AI-assisted analysis is shrinking the time from patch release to working exploit.
How did hackers weaponize the PHP2Shell flaw days before the October 2026 patch, and was an insider leak to blame?
If unauthenticated memory leaks bypass application security entirely, is any internet-facing PHP server truly safe from the PHP2Shell fallout?
With AI shrinking the exploit window to zero, are traditional patch management strategies now completely obsolete against automated threats?
PHP2Shell Crisis: How AI-Discovered Memory Flaws in PHP Exposed 22 Million Servers to Unauthenticated RCE and Global Regulatory Upheaval
Overview
The PHP2Shell crisis began when AI-powered research teams at Calif and Wiz independently discovered critical PHP memory flaws in August 2026, leading to a coordinated embargo for patch development. However, early attack reconnaissance was detected by Amazon, and leaks on social media and a public proof-of-concept video by Calif accelerated exploit development. Cloudflare and Chainguard rushed to deploy emergency protections, but the release of pre-patched images allowed attackers to reverse-engineer the vulnerabilities before official patches. As exploits spread, governments and agencies took web portals offline, and international cybersecurity authorities issued emergency directives, highlighting the urgent need for rapid, AI-aware defense strategies.