# Hackers targeted PHP flaws four days before public disclosure

- URL: https://talkfuse.com/story/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/
- Published: 2026-10-22T15:25:02+00:00
- Updated: 2026-10-22T17:40:19+00:00
- Original publisher: Ars Technica
- Original article: https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/
- Topics: Art, Celebrity, Culture, Cybersecurity, Entertainment, Technology

## Key points

- Hackers tried to exploit the PHP flaws four days before disclosure.
- PHP developers released patches on Wednesday.
- Authorities urged organisations to update systems or take them offline.

## Summary

Hackers attempted to exploit two serious PHP vulnerabilities four days before they were publicly disclosed, Amazon said, and the flaws are now being widely exploited. The episode has prompted urgent warnings to update or take affected systems offline, as PHP underpins a large share of websites.

Researchers at Calif and Wiz found the flaws with help from AI tools, and PHP developers released patches on Wednesday. Wiz estimates PHP powers about 70 per cent of websites, partly because WordPress relies on it; UK authorities warned the bugs could let attackers take control of a server without logging in.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.