Hackers Began Exploiting PHP Flaws Days Before Patches Were Released
Amazon Web Services data shows at least one attacker tried to exploit two critical PHP vulnerabilities on October 17, four days before public disclosure. AWS says AI is speeding up exploit development.
Two critical vulnerabilities in PHP, a widely used web scripting language, were being exploited before their fixes were made public on Wednesday. That is according to research published Wednesday evening by Amazon Web Services (AWS), Amazon's cloud computing arm. The flaws are known together as PHP2Shell, and the findings suggest the rush to patch websites was already too late in some cases.
The early attempt
AWS analysts reviewed logs from their honeypots, which are intentionally vulnerable servers used to study attack methods, and found an exploitation attempt dated October 17. It came from an IP address linked to a commercial anonymization network, meaning a proxy network or VPN.
CJ Moses, AWS's chief information security officer, wrote that targeting a honeypot from an anonymized address while the bug was under embargo points to a threat actor. How that actor obtained exploit information before disclosure remains unclear.
Wednesday's events
After the fixes were released, administrators and security staff raced to find and patch vulnerable sites and apps, while attackers studied the fixes to learn how to exploit the flaws. Some governments and other groups even took key websites offline beforehand so they would not be targeted before patching.
Proof-of-concept exploits began appearing publicly on Wednesday, some hours before the disclosure at 10 am Eastern Time. In the hours before it, AWS honeypots were hit by multiple attempts routed through various anonymization providers, apparently with different goals, which likely points to several actors. Moses said technical analysis continues and it is unclear whether the attempts would have worked on real systems, but that PHP2Shell is now being broadly exploited in the wild.
The role of AI
AWS argues the findings show coordinated vulnerability disclosure must evolve and speed up, because AI tools accelerate vulnerability analysis and let less skilled actors build exploits quickly. Moses said that in the past most exploitation followed a public proof of concept, whereas now more actors can act within hours or even minutes of technical details being disclosed.
The PHP Foundation did not immediately respond to WIRED's request for comment.
/nginx/o/2026/10/14/17973585t1h213b.jpg)
