# Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched

> **Publication**: aitalky (Independent AI Journalism)
> **Canonical Citation URL**: https://aitalky.vercel.app/news/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched
> **Original Source**: [Wired AI](https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/)
> **Author**: Lily Hay Newman (undefined)
> **Published Date**: Thursday, October 22, 2026
> **Category**: CULTURE
> **Tags**: AI, Wired AI, culture

## Executive Summary
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being "broadly exploited" across the internet



## Full Coverage
Wednesday's release of fixes for two critical vulnerabilities in PHP caused administrators and security staff to race to identify and patch vulnerable websites and apps, while attackers inevitably reverse engineered the fixes to learn how to exploit the flaws. Some governments and other groups even proactively took key websites down in anticipation of the release, so they wouldn't be targeted before they could apply the patches

But in addition to detecting such active exploitation on Wednesday, research published Wednesday evening by Amazon Web Services indicates that at least one actor had started attempting to exploit the bugs—known collectively as PHP2Shell—on October 17, four days before Wednesday's public revelations

AWS analysts spotted the October 17 exploitation on Wednesday while looking back at activity on one of their so-called honeypots, or intentionally vulnerable web servers or other digital lures that help researchers study attack methods and trends. The attempt came from an IP address that AWS says is linked to a "commercial anonymization network," in other words a proxy network or VPN

---
*Generated for AI agents and LLM citation by aitalky (https://aitalky.vercel.app).*