Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched

Live updates

1. 1h ago

   Hackers Exploited PHP Flaws Days Before Patches

   Hackers targeted critical PHP2Shell vulnerabilities days before public disclosure and subsequent patches, triggering a global security scramble. Amazon Threat Intelligence and AWS identified the exploitation prior to public notification in MadPot. Websites globally experienced millions of attempts to exploit the code flaws, prompting cyber chiefs to order critical safety updates or take vulnerable systems offline. Cloudflare deployed protections against the vulnerability while security agencies recommended immediate patches.

   Why it matters

   The severe remote code execution vulnerabilities affect a foundational web programming language utilized widely across global internet infrastructure. Autonomous artificial intelligence agents and human attackers leveraged the flaws before developers issued security patches. The incident forced numerous operators to take websites dark to address the threats.

   What is confirmed

   • Hackers attempted to exploit security vulnerabilities in PHP several days before the flaws became public.
   • Amazon Threat Intelligence identified PHP2Shell exploitation prior to public disclosure in MadPot.
   • Cloudflare deployed protections against the php2shell vulnerability.
   • Websites across the world were hit by millions of attempts to exploit the PHP code flaw.

   What to watch next

   • Further disclosures from threat intelligence firms regarding the origin and scale of the pre-patch exploitation.
   • Updates on global website recovery rates and the deployment of patches.
   Sources used for this update (25)

   1. BBC — Cyber chiefs tell websites to make critical safety update or go offline
   2. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   3. Cloudflare Blog — Cloudflare deploys protections against php2shell vulnerability
   4. OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities
   5. National Security Agency (NSA) (.gov) — NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
   6. The Atlantic — Read This Website While You Still Can
   7. WIRED — Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
   8. Amazon Web Services — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
   9. BBC — PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live
   10. Tech Xplore — Some websites go dark as operators address an AI-detected flaw in a web programming language
   11. BBC — Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb
   12. CNN — Websites shut down globally after AI finds a critical flaw affecting 70% of the internet
   confidence 100%