Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’

Live updates

1. 56m ago

   Amazon warns AI-detected cyber flaws face broad exploitation

   Amazon warns that critical cyber flaws detected using artificial intelligence are undergoing widespread exploitation in the wild. The vulnerabilities, known as PHP2Shell and affecting code vital to an estimated 70 percent of the internet, have triggered a global scramble for urgent security fixes and knocked many websites offline. Amazon Threat Intelligence reported detecting an exploit attempt against its MadPot honeypot service before the public disclosure of the vulnerabilities. Organizations worldwide are coordinating responses as automated agents uncover critical system weaknesses.

   Why it matters

   The emergency stems from newly disclosed vulnerabilities impacting a substantial portion of global websites, creating severe risks of server takeovers. The incident highlights the growing role of artificial intelligence in both uncovering critical flaws and accelerating adversarial attacks. Security teams are scrambling to patch systems as active exploitation threatens web infrastructure on a massive scale.

   What is confirmed

   • Amazon Threat Intelligence detected an attempt to exploit PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service.
   • The exploit attempt originated from an IP address associated with a commercial anonymization network.
   • CJ Moses, CISO of Amazon Integrated Security, stated that targeting a honeypot from an anonymized IP address suggests activity by a threat actor.
   • The code vulnerability impacts an estimated 70 percent of all websites and could allow attackers to take over servers.

   Still unconfirmed

   • It remains unclear how the threat actor acquired exploit information prior to public disclosure.

   What to watch next

   • Broader attribution of the threat actors behind the pre-disclosure exploitation attempts
   • Further reports on the scope of website outages and server takeovers globally
   Sources used for this update (12)

   1. help.naver.com — Futures Flat As Oil Rebounds After Trump's "Energy Ceasefire" Unravels, Memory Stocks Slide | ZeroHedge
   2. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   3. OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities
   4. Amazon Web Services — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
   5. Financial Times — Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’
   6. BBC — PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
   7. www.dailykos.com — Overnight News Digest: October 21, 2026 - Daily Kos
   8. thezvi.substack.com — The Hackening - by Zvi Mowshowitz
   9. www.businessinsider.com — Inside the cyber flaw scramble that brought the AI threat to life
   10. abc7.com — PHP code risk: Urgent security fix issued for code vital to estimated 70% of all websites - ABC7 Los Angeles
   11. www.illumio.com — PHP2Shell: What the Critical PHP Flaws Mean and What to Do | Illumio
   12. thehackernews.com — Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
   confidence 100%