Hackers exploited critical PHP2Shell zero-day four days prior to emergency patches
AWS and the NSA confirm active in-the-wild exploitation of remote code execution flaws affecting legacy CGI wrappers across millions of production web servers.
Technology news
Amazon Web Services and international cybersecurity authorities disclosed on Wednesday that malicious threat actors had a four-day head start actively exploiting two critical zero-day vulnerabilities in the PHP runtime environment before security updates were made available to the public.[4]
The dual vulnerabilities—tracked under the banner PHP2Shell—allow unauthenticated remote attackers to bypass character sanitization routines in legacy Common Gateway Interface (CGI) implementations and execute arbitrary operating system commands with server daemon privileges. Amazon Cloud Security confirmed it observed targeted exploitation attempts beginning on October 14, four days before PHP maintainers pushed emergency patches on October 18, and warned that automated scanning is now occurring on a global scale across public IP ranges.[4]
The severity of the threat prompted the US National Security Agency (NSA) and the UK National Cyber Security Centre (NCSC) to issue rare concurrent directives instructing all government agencies and private cloud operators to patch immediately or disconnect unmitigated PHP web hosts from the public internet. Security analysts highlighted that the underlying flaws had survived undetected in the PHP core codebase for more than a decade until automated AI code-auditing models from OpenAI and Google flagged the edge cases during ongoing security research.[4]
Our take: PHP still underpins nearly 75 percent of all web servers worldwide, meaning even a legacy CGI edge-case vulnerability poses staggering systemic risk to the open internet. The discovery of PHP2Shell by AI-assisted code analysis is both an achievement and a warning: defensive teams may find bugs faster with LLMs, but threat actors are equally capable of weaponizing unannounced flaws before software maintainers can coordinate global patch distribution.