PHP2Shell: Hackers Exploited Critical PHP Flaws Four Days Early
Amazon says hackers targeted critical PHP flaws four days before disclosure, exposing servers across a language used by about 70% of websites worldwide.
Summary
Amazon, the world’s largest cloud provider, said on October 21, 2026, that it detected an attempt to exploit two critical PHP vulnerabilities four days before public disclosure. The flaws, undetected for more than a decade and now broadly exploited, could let attackers seize servers without login credentials and reach file systems or databases. Alphabet-owned Wiz estimates PHP powers about 70 percent of websites, largely through WordPress, while European governments reportedly took sites offline for patching.
Calif and Wiz discovered the bugs using OpenAI and Google models. OpenAI then worked with PHP, Calif and Wiz to verify them and develop patches released October 21. OpenAI said frontier AI found the flaws before attackers but warned that equivalent capabilities could rapidly produce offensive tools. The NSA told PHP users to update immediately or disconnect affected systems, Britain’s NCSC urged immediate action, and the White House began assessing federal systems and critical infrastructure. Earlier in 2026, powerful cyber models from Anthropic and OpenAI prompted warnings from politicians and financial regulators, leading the US government to temporarily restrict their rollout.
Positives
- PHP maintainers released patches on October 21, 2026, after working with OpenAI, Calif and Wiz.
- OpenAI and Google models helped uncover two vulnerabilities that had remained undetected for more than a decade.
- The NSA and Britain’s NCSC issued immediate mitigation guidance for organizations operating PHP systems.
- The White House began assessing possible effects on federal systems and critical infrastructure.
Risks & concerns
- Amazon detected an exploitation attempt four days before disclosure and says the PHP flaws are now broadly attacked.
- About 70 percent of websites use PHP, according to Alphabet-owned Wiz, giving the vulnerabilities exceptional reach.
- Unauthenticated attackers could take control of servers and directly access their file systems or databases.
- European governments reportedly took websites offline while installing patches, showing the mitigation’s disruptive cost.
- AI capabilities that discovered the flaws could also help attackers rapidly create offensive tools and exploits.