AI News Feed
Market watch
Seoul Shares Open Sharply Lower as AI Woes Persist, Oil Prices RiseResearcher Demonstrates Software-Only Partial Jailbreak of Switch 2Amazon Says PHP2Shell Attacks Began Four Days Before Patches as Attempts Reach MillionsStrava Revamps Route Discovery With Smarter Search and Offline MapsSpotify confirms QR code checks for Family plan sharingFortune report puts next Xbox at $1,200 to $1,800, testing Microsoft's affordability pledge
Seoul Shares Open Sharply Lower as AI Woes Persist, Oil Prices RiseResearcher Demonstrates Software-Only Partial Jailbreak of Switch 2Amazon Says PHP2Shell Attacks Began Four Days Before Patches as Attempts Reach MillionsStrava Revamps Route Discovery With Smarter Search and Offline MapsSpotify confirms QR code checks for Family plan sharingFortune report puts next Xbox at $1,200 to $1,800, testing Microsoft's affordability pledge
Cybersecurity

Amazon Says PHP2Shell Attacks Began Four Days Before Patches as Attempts Reach Millions

Amazon says PHP2Shell attacks began four days before patches, while Cloudflare logs millions of exploit attempts.

AI News Feed · 2026-10-23 10:08

Amazon said its MadPot honeypot network recorded the earliest attempt on Oct. 17, while the vulnerabilities were still under embargo. The traffic came from an IP address tied to a commercial anonymization network. CJ Moses, chief information security officer of Amazon Integrated Security, wrote in a blog post that it is unclear how the attacker obtained exploit information before disclosure. More probes reached the honeypots in the hours before Wednesday’s release. Amazon said their payloads and anonymized infrastructure varied enough that it suspects more than one actor was involved. It is still unknown whether any early attempt would have worked on a real system.

The two bugs had sat in PHP’s code for years until an August audit financed by OpenAI Group PBC used an artificial intelligence model to show they could be exploited in practice. Fresh proof-of-concept exploits surfaced within hours of the patch and were turned on Amazon’s sensors almost immediately. Amazon now describes the flaws as being broadly exploited in the wild. The company said investigations should start from Oct. 17 at the latest, arguing that seven- and 30-day remediation windows assume a delay attackers no longer give and that patch timelines should be measured in hours.

Cloudflare Chief Executive Matthew Prince wrote on X late Wednesday that the network logged thousands of attempts in the 10 hours before disclosure. Tens of thousands followed in the 45 minutes after the announcement and hundreds of thousands within two hours. By the time he posted, the count had passed into the millions. None of that traffic has yet been tied to a confirmed break-in.

WordPress security company Defiant said its Wordfence firewall has blocked more than 74,000 exploit and probing attempts. Across more than 5 million WordPress sites it protects, Defiant has not seen a single confirmed compromise. Real-time event and risk detection company Dataminr described the activity it observed as limited to scanning, fingerprinting and use of non-working exploits, and said working attacks were only a matter of time.

Organizations around the world have pulled services offline. Several cybersecurity agencies, including the U.S. National Security Agency, advised on Wednesday that systems be taken offline if they could not be updated immediately. Reuters reported that banking, rail and government services were taken down as a precaution from Tokyo to Helsinki. In Japan, broker Nomura Holdings, lender Mitsubishi UFJ Financial Group and East Japan Railway suspended some internet services, and the National Tax Agency temporarily took its service down. South Korea raised its private-sector cybersecurity alert level, citing a higher risk of hacking.

Finland’s state IT services provider, Valtori, began lifting its blocks on government web services after patching overnight. Director General Hannu Naumanen said restoring them can take days or even weeks because the systems need careful testing. Microsoft Chief Executive Satya Nadella said at an event in Germany that he had not seen anything like this in a long time, according to Reuters. For IT and security staff, he said, it was a long day and a long night.

Michael Centrella, head of public policy at SecurityScorecard and a former assistant director of the U.S. Secret Service, told SiliconANGLE that agencies should rank exposed systems by mission impact, including public safety, health and payments. He said what looks like hundreds of separate vulnerabilities could represent a smaller number of common points of failure capable of creating cascading disruption.

Some servers may never take the fix. Felix Kuhlenkamp, head of security at German digital industry association Bitkom, told Reuters that many smaller operators run a website using PHP but do not keep a close eye on it. Where a site sits on an old version with no security update, he said, the entire system must be updated. Justin Beals, founder and chief executive of Strike Graph, told SiliconANGLE that the end-of-life count should stop people. He pointed to figures from vulnerability intelligence company VulnCheck showing at least 1 million internet-facing hosts on PHP versions that no longer get updates.