WIREDSECURITYPOLITICSTHE BIG STORYBUSINESSSCIENCECULTUREREVIEWSMenuWIREDAccountAccountNewslettersSecurityPoliticsThe Big StoryBusinessScienceCultureReviewsChevronMoreExpandThe Big InterviewMagazineEventsWIRED InsiderWIRED ConsultingNewslettersPodcastsVideoLivestreamsWIRED StoreSearchSearchClose BannerClose00Days:00Hours:00Minutes:00SecondsJoin us in MiamiSee the full lineupLily Hay NewmanSecurityOct 21, 2026 10:24 PMHackers Exploited the PHP Vulnerabilities Days Before They Were PatchedAmazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet.Photo-Illustration: Jobanny Cabrera; Getty ImagesCommentLoaderSave StorySave this storyCommentLoaderSave StorySave this storyThe internet’s mad scramble on Wednesday to patch a pair of critical vulnerabilities in PHP, a widely used web scripting language, was already too late to stop every attack, newly released details reveal.

Wednesday’s release of fixes for two critical vulnerabilities in PHP caused administrators and security staff to race to identify and patch vulnerable websites and apps, while attackers inevitably reverse engineered the fixes to learn how to exploit the flaws. Some governments and other groups even proactively took key websites down in anticipation of the release, so they wouldn't be targeted before they could apply the patches.

But in addition to detecting such active exploitation on Wednesday, research published Wednesday evening by Amazon Web Services indicates that at least one actor had started attempting to exploit the bugs—known collectively as PHP2Shell—on October 17, four days before Wednesday's public revelations.

AWS analysts spotted the October 17 exploitation on Wednesday while looking back at activity on one of their so-called honeypots, or intentionally vulnerable web servers or other digital lures that help researchers study attack methods and trends. The attempt came from an IP address that AWS says is linked to a “commercial anonymization network,” in other words a proxy network or VPN.

“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” CJ Moses, AWS's chief information security officer, wrote in the research post.

This article was aggregated automatically by CyberWire Daily's newsfeed engine. Original reporting: www.wired.com.