Hackers exploited AI-discovered PHP2Shell flaw four days before public disclosure, Amazon warns
Ars Technica AI · rss · 2026-10-22
Amazon warns that PHP2Shell vulnerabilities in PHP—discovered using AI tools—are being broadly exploited in the wild. The cloud giant says it identified exploitation attempts four days before the flaws were publicly disclosed, as governments and companies rush to patch systems supporting much of the internet.
More from Safety
- php2shell-poc open-sources two CVSS 9.2 pre-auth PHP RCE exploits affecting 14 years of releases — evilsocket · 2026-10-23
- Security Through Binary Patching: fixing critical PHP CVEs with radare2 in 24 bytes, no recompile — SIGKITTEN · 2026-10-23
- Geoffrey Irving: labs aren't playing 4D chess — do simple, correct things so others update — geoffreyirving · 2026-10-23
- Anthropic researcher's human-written essay flagged 92% AI by detector Pangram, sparking drama — sethlazar · 2026-10-23
- 86.7% of exploited CVEs are now zero-days: Kurtz on why PHP2Shell ends the patching window — joshua_saxe · 2026-10-23
- AI safety researcher: labs are at 'slapdash empirics' level, three tiers below aerospace-grade rigor — geoffreyirving · 2026-10-23