PHP2Shell Exploits Begin Oct 17

Hackers began exploiting PHP's critical flaws four days before the official patch, Amazon Web Services found. The flaws, dubbed PHP2Shell, were uncovered by AI tools from Wiz and OpenAI on Oct 15. The vulnerabilities let attackers seize control of web servers without authentication and siphon sensitive data. Governments worldwide, from the US NSA to Japan’s PM, urged immediate patching or site shutdown. The PHP Foundation released emergency fixes on Wednesday, but attackers already reverse engineered them. AWS honeypots logged multiple attempts from anonymized IPs, showing varied attack goals. Experts say AI‑driven analysis shortens the window from discovery to exploitation. OpenAI called the discovery 'one of the most impactful security issues' in recent memory. The incident highlights how quickly AI can turn code flaws into real‑world threats.