Critical PHP Vulnerability: Hackers Exploited Flaws Before Disclosure
Security analysts warn that AI-assisted exploitation is significantly shrinking the window for system administrators to secure their servers.
A serious security incident has emerged in the world of web development. Two critical vulnerabilities in PHP, one of the most widely used web programming languages, have left administrators in a difficult position. Although security patches to address these flaws were released on Wednesday, it has been revealed that hackers began exploiting them much earlier.
A Threat That Outpaced the Patch
Data published by Amazon Web Services (AWS) security analysts indicates that attempts to exploit the vulnerabilities, known as PHP2Shell, were detected as early as 17 October—four days before they were officially disclosed. AWS discovered this activity on its honeypots, which are intentionally vulnerable servers used to monitor hacker activity. The attacks were conducted via anonymised networks, specifically VPNs, making it difficult to identify the perpetrators.
CJ Moses, Chief Information Security Officer at AWS, noted that it remains unclear how hackers obtained information about the flaws before they were publicly known. However, the intensity of the attacks surged immediately following the release of the update on Wednesday. Experts suspect that various hacking groups began using the vulnerabilities independently, creating widespread risks across the internet.
Artificial Intelligence and Accelerated Threats
Experts highlight that this case points to an alarming new trend in cybersecurity. In the past, hackers often required days or weeks to study patch details and develop exploits; today, that process has been reduced to hours or even minutes. The primary driver of this shift is artificial intelligence, which accelerates automated analysis.
"AI-assisted analysis lowers the cost and speeds up the process of turning technical patch details into functional exploits. As a result, many more people can act in a very short amount of time," CJ Moses explained. This shift means that time is now a critical factor for software developers and system administrators. Any delay in applying updates can prove fatal.
What Users Should Know
PHP-based sites and services account for a significant portion of the web worldwide. As PHP2Shell is already being actively exploited in the wild, any website owner using PHP must immediately verify their server security and install the latest patches. Security experts advise that to prevent similar incidents, server software should be kept up to date at all times, and monitoring of critical services should be strengthened.