Amazon says attackers began probing two serious vulnerabilities in PHP four days before the flaws were publicly disclosed, adding that exploitation is now widespread.
The company’s warning, reported by Ars Technica from Financial Times coverage, came as the US National Security Agency and the UK’s National Cyber Security Centre urged organizations using PHP to update immediately or take affected systems offline.
PHP underpins a large share of the web, including WordPress sites. Wiz has estimated that the language is used by roughly 70 percent of websites worldwide. The UK agency said the flaws could potentially let attackers take control of a website’s server without valid credentials.
AI-assisted discovery, fast-moving risk
Researchers from Calif and Wiz identified the vulnerabilities with assistance from AI models, after the flaws had apparently remained undetected for more than a decade. OpenAI said the case demonstrated that advanced AI could find security weaknesses with internet-scale consequences, while warning that similar capabilities could help attackers create exploits more quickly.
OpenAI, PHP maintainers, Calif and Wiz worked together to validate the findings and prepare fixes. PHP developers released patches on Wednesday, according to the report.
The White House said it was assessing possible effects on US government systems and critical infrastructure. The NSA said the vulnerabilities could provide a direct route to a server’s file system or database and advised organizations unable to patch promptly to take systems offline until they could be mitigated.