Hackers had a four-day head start exploiting severe PHP vulnerabilities discovered by OpenAI, Calif, and Wiz, flaws affecting up to 70% of websites worldwide and prompting urgent alerts from the NSA, NCSC, and White House.
<p>Amazon has warned that <a href="https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/">vulnerabilities in a programming language</a> that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems.</p>
<p>The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public.</p>
<p>Amazon added the flaws were “now being broadly exploited in the wild.”</p><p><a href="https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/">Read full article</a></p>
<p><a href="https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/#comments">Comments</a></p>
AWS threat intelligence reveals attackers began exploiting the critical PHP2Shell vulnerabilities four days before their public disclosure and patch release, highlighting how AI-accelerated exploit development is shrinking the window between patch and working exploit.
Two critical PHP runtime vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed php2shell) that had existed for over a decade were demonstrated as exploitable with the help of frontier AI models, prompting a coordinated defense across the web including pre-disclosure Cloudflare WAF protections.
Wiz disclosed PHP2Shell, two critical decade-old PHP vulnerabilities that researchers turned into working exploits in about a week with help from Gemini and GPT models, prompting emergency patching and raising questions about AI-driven exploitation of legacy code.
OpenAI's Patch the Planet initiative and Google's Wiz used AI models like GPT-5.6 Sol and Gemini 4 Argon to uncover two critical, decades-old PHP vulnerabilities present since 2004, prompting an NSA warning and urgent patches from the PHP Foundation for the ~70% of websites running PHP.