Amazon says hackers tried PHP2Shell flaw four days before disclosure
Patches for two PHP flaws were released Wednesday, and the NSA urged operators to update or take sites offline.
Code#01
70%
Share of websites running PHP
Image: Ars Technica
70%Share of websites running PHP
The short version
- Amazon said it identified an attempt by hackers to exploit the bug four days before public disclosure.
- The NSA and UK authorities warned that the two vulnerabilities left websites worldwide critically exposed.
- The NSA told organizations using PHP to update immediately or take their systems offline.
- Researchers at Calif and Wiz found the flaws with help from OpenAI and Google models after they went undetected for more than a decade.
Why it matters
The case shows AI tools can find decades-old flaws in widely used software, and OpenAI said the same capabilities can help attackers build exploits. For developers, PHP 8.1 and older versions are no longer supported, and the recommended step is to update to the current version, 8.5.12.
“To our knowledge, frontier AI found these vulnerabilities before attackers did.”
What people are saying
Commenters questioned the two-month gap between reporting and disclosure. One noted the flaw was in at least 20-year-old code and that no compute costs were disclosed. Another asked for a reputable source of code to validate fixes.