Amazon and AI Expert Warn of Rapid PHP2Shell Cyber Attacks
A global cybersecurity warning was triggered by a PHP vulnerability that went undetected for at least a decade. On October 17, an anonymous internet address targeted weaknesses in an Amazon honeypot system in what the company identified as a “PHP2Shell exploitation attempt”.
Amazon Details Rapid Cyber Attacks
Amazon’s security chief CJ Moses stated that the initial attack used an anonymous IP address, suggesting activity conducted by a “threat actor”. Although the PHP Foundation originally planned to release its discovery later this month alongside a complete fix—known to software developers as a “patch”—details regarding the flaw leaked on social media on Tuesday. Subsequent attacks on Amazon took place on October 21. According to Moses, the actual payloads and choices in anonymisation infrastructure varied, suggesting these were multiple actors.
These subsequent incidents occurred after the social media leak but before the embargo on the PHP warning was lifted. Moses further noted that the use of artificial intelligence means more actors can act within hours or even minutes once technical details of a vulnerability are disclosed
.
AI Compresses Time to Expose Cybersecurity Vulnerabilities
The PHP incident has demonstrated how quickly AI is changing our cybersecurity landscape
, according to Australian Council on AI Strategy CEO Anna-Maria Arabia, who told the BBC that exposure times have drastically compressed. What used to take months, to expose a vulnerability, is now taking days,
Arabia said, warning that such threats will only become more commonplace as AI technology rapidly improves, adding that it is not going backwards, in other words
.
The underlying PHP flaws remained unnoticed for at least a decade. In the wake of the disclosure, cybersecurity firm Wiz estimated that roughly 70%
of the internet is affected by the issue, although this specific figure remains unverified independently.