Amazon caught hackers probing a PHP flaw 4 days before the fix

Most security breaches start with a lock nobody knew was broken.

For years, that was the comfortable assumption behind the software that runs the internet. Bugs existed, but finding the dangerous ones took rare skill and a lot of time.

That buffer has quietly disappeared. Artificial intelligence is now finding old flaws faster than humans can patch them, and attackers are using the same tools to turn fixes into weapons.

If you have a website for your business, your side hustle or your church, this one lands on you too.

The fix is free and already out. The hard part is getting it onto millions of servers before attackers get there first, and that race started earlier than most people realize.

It also explains why Wikipedia, the Port of Rotterdam, and France’s Interior Ministry all pulled sites offline on Oct. 21.

I spent the morning going through the disclosures, and one detail stands out more than any outage list.

Amazon (AMZN) says its security team caught someone trying to exploit the newly discovered flaws in PHP, the programming language behind most of the web, on Oct. 17. That was four days before the developers released a fix, according to a post on Amazon’s security blog.

Amazon’s honeypot saw the attack before the public did

Amazon runs decoy servers, known as honeypots, to watch what attackers do. One of them recorded an exploit attempt from an anonymized internet address while the flaws were still under embargo, wrote CJ Moses, chief information security officer of Amazon Integrated Security.

It is still unclear how the attacker learned about the bugs early. Moses said proof-of-concept exploits were circulating as early as 2 a.m. UTC on Oct. 21, about 12 hours before the official release.

“PHP2Shell is now being broadly exploited in the wild,” Moses wrote.

More Technology:

The flaws, tracked as Common Vulnerabilities and Exposures (CVE) entries CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a vulnerable server without logging in. Cybersecurity firm Wiz, which Alphabet (GOOGL) owns, said it found them with help from its own AI tool plus Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, according to its research post.

Wiz said the bugs reach back to PHP 5.4 and had been hiding in the code for more than a decade. “Applying the PHP security update remains the only complete remediation,” the firm wrote.

Moses explained why the window keeps shrinking. “AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit,” he wrote.

Governments pulled sites offline as PHP shipped fixes

The scale is what spooked officials. “All servers using any version of PHP released in the last 20 years will be vulnerable,” Tiffany Farriss, interim chief executive of the Drupal Association, told Reuters.

PHP runs roughly 75% of websites whose programming language can be identified, according to web tracker W3Techs, as cited by Reuters. It sits under WordPress, Drupal, Joomla and Magento.

Here’s how the response played out across the first 48 hours:

The Netherlands’ National Cyber Security Centre took its own site offline, and the Port of Rotterdam, government portal Overheid.nl and several hospitals followed, according to Reuters.
European cyber agencies, including the European Union Agency for Cybersecurity (ENISA), told organizations to “consider isolating exposed applications” if they cannot patch right away, according to a joint statement.
Attackers began altering their payloads to slip past filters, Cloudflare (NET) said, as reported by The Hacker News.
PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC on Oct. 21, according to The Repository, a WordPress industry newsletter.

Costin Raiu, co-founder of security firm TLP:Black, warned that the next phase could be “mass compromise of every vulnerable web server on the internet,” Reuters reported.

Amazon says hackers tried to exploit two critical PHP flaws on Oct. 17, four days before the fix went public.

Yong Teck Lim / Getty Images

Censys count shows 1.5 million servers need upgrades

In my analysis, the outage headlines understate the real exposure. Internet scanning firm Censys counted about 1.5 million of 2.6 million hosts running a PHP version with no fix available, according to Reuters.

That is roughly 58%. Those servers cannot simply be patched; they need a full upgrade to a newer PHP release, which takes longer and can break older websites.

That gap will not close in a week. It means the risk window stays open well after the headlines fade.

Hosting companies are moving at different speeds

Most people with a website never touch PHP directly. Your hosting company does, and the responses so far vary.

Automattic said customers of WordPress.com and its other managed platforms were protected before the release.

“On WordPress.com, security is our job to solve, not yours,” said Ian Stewart, the company’s artistic director and product lead, according to The Repository.

GoDaddy (GDDY) said its Managed WordPress hosting was fully patched, while its standard Web and Windows Hosting still relied on interim protections as of Oct. 22, the newsletter reported. Bluehost warned that customers may see limits on upload file sizes while it finishes patching.

Risk is highest for small sites run by people with limited technical help, often on shared hosting where customers do not manage the servers, Reuters noted.

3 checks for your own website this week

You do not need to be a programmer to protect yourself. Start with three steps:

Check your PHP version. In WordPress, it appears under Tools, then Site Health, then Info.
Ask your host directly whether your server runs 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. Get the answer in writing.
If you sell anything online, review recent orders and admin accounts for anything you do not recognize, and save your logs from Oct. 17 onward, as Amazon advised.

If you are still on PHP 8.2 or older, plan an upgrade now. PHP 8.2 reaches end of life on Dec. 31, according to The Repository.

Investors get a stress test for Cloudflare and GoDaddy

For investors, the story cuts both ways. Amazon and Alphabet just showed their security teams can spot threats early, while Cloudflare’s filtering business gets a real-world stress test.

GoDaddy carries more operational risk, because its customers skew toward small businesses on shared plans. I will be watching whether any host reports a breach tied to these flaws in the coming weeks.

The bigger shift is the speed. “The scale is huge, and with AI, exploitation may happen instantly,” Lukasz Olejnik, a visiting senior research fellow at King’s College London, told Reuters.

Your website is part of your income now. Treat your host’s patch status the way you treat a bank alert: check it today, not next month.