Hackers targeted PHP flaws four days before public disclosure

Hackers attempted to exploit two serious PHP vulnerabilities four days before they were publicly disclosed, Amazon said, and the flaws are now being widely exploited. The episode has prompted urgent warnings to update or take affected systems offline, as PHP underpins a large share of websites.

Researchers at Calif and Wiz found the flaws with help from AI tools, and PHP developers released patches on Wednesday. Wiz estimates PHP powers about 70 per cent of websites, partly because WordPress relies on it; UK authorities warned the bugs could let attackers take control of a server without logging in.