A Global Scramble to Patch
The flaws were first discovered by AI, and governments quickly urged anyone using PHP to deal with them. A UK government spokesperson called on "all organisations, private and public, large and small" to follow the guidance. The UK's National Cyber Security Centre (NCSC), along with its counterparts in the EU and Australia, urged PHP users to apply the fixes. "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC advised.
Some organisations did exactly that. The Dutch cybersecurity agency went offline as a precaution, Finland's government shut down its public web services, and Wikipedia took down parts of its website. That matched advice from governments, including the US, to pull sites down if the flaws couldn't be fixed immediately.
The US National Security Agency said the vulnerabilities "often provide a direct path to the server's file system or database." Attackers could steal sensitive data, disrupt services or move deeper into a network, it added, stressing that the flaws are in PHP itself, not in the hosted application or its configuration. OpenAI called the discovery "one of the most impactful security issues in recent memory." Cyber-security firm Wiz has estimated that "roughly 70%" of the internet is affected, though that figure hasn't been independently verified. The flaws went undetected for at least a decade.
Amazon Was Targeted Before the Embargo Lifted
Amazon said on Wednesday that it had spotted a "PHP2Shell exploitation attempt" on 17 October. According to its security chief CJ Moses, an anonymous internet address tried to target weaknesses in one of the company's decoy, or "honeypot," systems. The anonymous address suggests a "threat actor" was behind it, he said.
The PHP Foundation had planned to release its discovery later this month together with a complete fix, usually called a patch. But details of the flaw leaked on social media on Tuesday. In later attacks on Amazon on 21 October, "the actual payloads and choices in anonymisation infrastructure varied, suggesting these were multiple actors," Moses said. Those attacks came after the leak but before the embargo on the warning was lifted, and Amazon said it was unclear how the attackers knew about the vulnerabilities.
Moses said AI means "more actors can act within hours or even minutes once technical details of a vulnerability are disclosed."
AI Is Changing the Security Landscape
Anna-Maria Arabia, CEO of the Australian Council on AI Strategy, said the incident has "demonstrated how quickly AI is changing our cybersecurity landscape." What used to take months to expose, she said, now takes days. She warned that such threats will only become more common as AI improves. It is "not going backwards, in other words," she said.
