Amazon Warns PHP Flaws Are Broadly Exploited After Hackers Got 4-Day Head Start
Updated
Updated · Ars Technica · Oct 22
Amazon Warns PHP Flaws Are Broadly Exploited After Hackers Got 4-Day Head Start
3 articles · Updated · Ars Technica · Oct 22
Summary
Amazon said attackers tried to exploit the PHP vulnerabilities four days before public disclosure, and the flaws are now being “broadly exploited in the wild.”
Two bugs in PHP — software underpinning much of the internet — prompted the NSA and UK authorities to urge organizations to patch immediately or take systems offline.
PHP maintainers released fixes on Wednesday, while some European governments were reportedly already taking websites offline during emergency patching.
The vulnerabilities had gone undetected for more than a decade and were uncovered with help from OpenAI and Google models, underscoring how AI is reshaping cyberdefense and cyber risk.
Why did European governments take official websites offline to patch a PHP flaw, and what does this reveal about web security?
How did AI models uncover the decade-old PHP2Shell vulnerability, and could these same tools accelerate future cyberattacks?
With over 22 million PHP instances exposed to critical remote code execution, how can organizations protect their unsupported legacy systems?
PHP2Shell and the October 2026 Web Crisis: How AI Unleashed a Decade-Old Vulnerability Affecting 70% of Websites
Overview
The October 2026 PHP2Shell crisis began when security researcher Ryan Austin, using OpenAI’s GPT-5.6 Sol model, uncovered critical memory flaws in PHP. After reporting the issue to the PHP Foundation, a coordinated patching effort started, but an unauthorized leak forced emergency updates. The vulnerabilities allowed attackers to exploit persistent web worker processes, leading to remote code execution and data leaks. Global agencies issued urgent advisories, and organizations deployed temporary mitigations, but about half of PHP systems remained unpatched due to legacy versions. The incident highlights how AI accelerated both discovery and exploitation, reshaping the cybersecurity landscape.