Amazon disclosed on Wednesday that it detected a PHP2Shell exploitation attempt on 17 October.
The attack originated from an anonymous IP address and targeted vulnerabilities in one of Amazon’s decoy or “honeypot” systems, according to CJ Moses, the firm’s security chief.
The use of an anonymous IP indicates the activity was carried out by a threat actor, he said.
Although the PHP Foundation planned to release its findings and a full patch later this month, details of the flaw were posted on social media on Tuesday.
Subsequent attacks on Amazon on 21 October showed varying payloads and anonymisation methods, indicating multiple actors, Moses added.
These attacks took place after the leak but before the embargo on the PHP warning was lifted.
AI enables more actors to act within hours or even minutes once vulnerability details are disclosed, Moses noted.
The PHP incident has demonstrated how quickly AI is reshaping the cybersecurity landscape, said Anna‑Maria Arabia, CEO of the Australian Council on AI Strategy, telling the BBC that exposure times have dropped from months to days.
She warned that threats will become more frequent as AI technology advances, noting, “It is not going backwards, in other words.”
The PHP vulnerabilities remained undetected for at least a decade.
Cybersecurity firm Wiz estimates that roughly 70 % of the internet is affected, a figure the BBC cannot independently verify.
Also Read
- IMF sees 1.3% contraction in Middle East, North Africa and Pakistan in 2026
- Man Charged After Alleged Nunchuck Threat at Minister Hannah Beazley’s Office
- Palestinian Youth Put Themselves at Risk to Shield Photojournalist in West Bank Attack, She Says
- Russia and Ukraine exchange overnight strikes after Witkoff-Putin meeting
