# Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched

- URL: https://talkfuse.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
- Published: 2026-10-22T02:24:17+00:00
- Updated: 2026-10-22T03:16:16+00:00
- Original publisher: Wired
- Original article: https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
- Topics: Cybersecurity, Technology

## Key points

- AWS found a PHP2Shell exploit attempt dated 17 October.
- The attempt preceded public disclosure and patches by four days.
- AWS says the flaws are now being widely exploited.

## Summary

Amazon Web Services says an actor tried to exploit two critical PHP flaws on 17 October, four days before the vulnerabilities were publicly disclosed and patched. The early attempt highlights the risk that attackers may obtain or develop exploit information before fixes are announced, while defenders are still preparing to update affected systems.

AWS found the activity when it reviewed data from a deliberately vulnerable honeypot; the attempt came from an IP address linked to a commercial anonymisation network. Researchers also saw several attacks around the public disclosure, and AWS says PHP2Shell is now being widely exploited, though it is unclear whether the observed attempts would have worked against real systems. AWS argues that AI tools can help more attackers turn technical details into exploits quickly, putting pressure on vulnerability disclosure and patching timelines.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.