Key points
- Amazon can't explain how the first attacker knew
- AI tools helped researchers uncover PHP2Shell
- Disclosure mistakes disrupted PHP's patch rollout
Amazon (AMZN) says an attacker tried to break into servers using two security flaws in PHP, software used to run websites, four days before the flaws were publicly disclosed. Known together as PHP2Shell, the flaws can let attackers run their own code on an affected server without logging in. Governments across Europe took some websites offline while installing fixes. Amazon hasn't determined whether the early attack attempts could have succeeded.
The PHP project released patches that day for the two flaws, CVE-2026-109618 and CVE-2026-109619. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP says there are no complete mitigations and urges users to update. Wiz, one of the security firms that found the flaws, says PHP powers 70% of all websites. That measures how widely PHP is used, not how many sites run a vulnerable version. Wiz says nearly every PHP version, including releases dating back to 5.4, has at least one of the flaws.
AI models helped find a bug PHP had seen before
Security firm Calif started auditing PHP on July 30 through the Patch the Planet program, which the PHP Foundation got PHP into. On August 11, Calif researcher Ryan A. reported a remote code execution flaw, and OpenAI independently reported the same root cause that day. Wiz reported more ways to exploit it on August 24.
Wiz says it used its own Wiz Atlas tool, OpenAI's GPT-5.6 Sol, and Google's Gemini 4 Argon, and that Argon made "an invaluable contribution" to finding the flaw and checking the fix. Wiz is owned by Google's parent, Alphabet (GOOGL). Google gave cyber defenders first access to Argon at the model's September 30 unveiling.
The problem wasn't entirely new. Work on fixes from a 2024 outside audit of PHP turned up the first signs of the out-of-memory issue behind CVE-2026-109618, the foundation says, but nobody found a concrete way to exploit it then. Work on a fix stalled and restarted over months, and the foundation blamed itself. "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources," the foundation wrote.
The bug was hard to exploit because an attack "requires millisecond timing," Alan Woodward of the University of Surrey told New Scientist. He said AI changed that. "But what AI does, it doesn't go for tea breaks, it doesn't go home at 6 o'clock: you can just set loads of them running and eventually they'll come up with the right answer of how to exploit it," Woodward said.
Disclosure mistakes forced an earlier release
PHP had planned to publish the fix on October 22. Around 3 p.m. UTC on October 20, the two CVE numbers started circulating online with the wrong release time and a wrong severity score of 10.0. The real score is 9.2. No technical details leaked, but PHP moved the release up a day, to 2 p.m. UTC on October 21.
More slips followed. Calif mistakenly posted a video that evening demonstrating how an attack could work against several targets. Copies spread after the video was deleted. At 7:41 a.m. UTC on October 21, software provider Chainguard published built images containing the fix more than six hours before the coordinated release. The foundation says that let any attacker study the fix while everyone else was still waiting. PHP's security team didn't find any working exploits by the time of the release.
Amazon saw an attack attempt before any of that
Amazon's threat intelligence team found an exploitation attempt against one of its decoy servers dated October 17, Amazon security chief CJ Moses wrote on October 21. The attempt came from an anonymizing network, and Amazon says it's unclear how the attacker learned about the flaw while it was still secret. More attempts from different sources followed from about 2 a.m. UTC on October 21.
Amazon says it doesn't know whether any of those early attempts would have worked on real systems. After the patch came out, though, its decoys were hit almost immediately. "PHP2Shell is now being broadly exploited in the wild," Moses wrote.
Al Jazeera tallied the government responses. The U.S. National Security Agency issued a rare public warning on October 21 and advised taking websites offline if they couldn't be updated right away. Germany's digital ministry took some sites offline as a precaution, and France's Interior Ministry shut down the websites of its local administrative offices. Belgium, the Netherlands, Finland, and the Czech Republic also took sites down to patch them, and Denmark took government websites offline as a precaution. Japanese Prime Minister Sanae Takaichi posted a warning on social media.
Woodward expects most large websites to have patched already, but says smaller sites with fewer resources could stay exposed for months or years. "There will be this long tail and you'll find some surprising sites have not been patched," he said.
Security stocks beat the Nasdaq
Zscaler (ZS) rose 7.8% on October 21, while Fastly (FSLY) gained 5.6%, and Cloudflare (NET) and CrowdStrike (CRWD) each added 5.3%, while Alphabet fell 1.6%. The Nasdaq rose 1.1% the same day, so it isn't clear how much of the move came from PHP2Shell. Cloudflare and Fastly were among the companies Wiz thanked for preparing protections for customers who can't patch yet. Cloudflare turned on protections for all customers using its firewall service, including free ones, at 3:02 a.m. UTC on October 21, before PHP's coordinated release. Cloudflare also saw attackers changing their payloads, the code they send in an attack, to try to get around them.
The PHP Foundation says the work on PHP's own security still depends on a small group of foundation-funded developers and a little volunteer help. "Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing," the foundation wrote. Earlier this month, a Korean bank hack showed how attackers are using AI tools too.
