What it means that Amazon detected attacks on the PHP flaw found with OpenAI's AI before the patch — October 23, 2026
· CompaniesAutomation
Radar Flash Edition: Amazon saw attacks on the PHP flaw found by OpenAI's AI four days before the patch. From what date to review your website.
Flash edition. A follow-up to this morning's Radar. The two critical PHP flaws we discussed yesterday, discovered using OpenAI's AI, were already being attacked before a patch existed.
What happened
Amazon detected an attempted attack against PHP2Shell on October 17 in its honeypot network, four days before the fix was published. It came from an anonymization network, and Amazon doesn't know how the attacker got the details. It urges companies to investigate from at least October 17 and to measure patching in hours: 7- or 30-day windows assume "a delay that no longer exists." It adds that no configuration setting fully fixes it; only updating does (Amazon Threat Intelligence).
Cloudflare counted tens of thousands of attempts in the first 45 minutes and millions by Thursday morning. There are still no confirmed intrusions: Wordfence has blocked more than 74,000 attempts without seeing a single case among the over 5 million WordPress sites it protects, and Dataminr warns that working attacks are "only a matter of time." In Japan, Nomura, MUFG, and JR East suspended some online services, and VulnCheck counts at least one million exposed servers with PHP versions that no longer receive fixes (SiliconANGLE). VulnCheck itself has already built a working exploit that succeeds against PHP's recommended production configuration (The Hacker News).
Why it matters
Until now, a website review started on the day of the patch. With flaws that AI finds and turns into attacks within hours, the date that matters is the first attempt, and nobody tells you when that was. Jason Clinton, Anthropic's deputy chief information security officer, urges security leaders to go to their boards and ask for help "not for ai, for the basics" (Business Insider).
For your business
- Your review starts on October 17. If you updated after reading yesterday's radar, ask your hosting or your agency to check the logs from that date on: new files, strange processes, and suspicious form submissions.
- Rotate the keys your website stores. The most repeated attack Wordfence is seeing attempts to read files containing database passwords and API keys (Wordfence). If your site was exposed, rotate them.
- Updating WordPress does not update PHP. Ask in writing for the version (8.5.12, 8.4.27, 8.3.36, or 8.2.35) and for PHP to be restarted.
On the AI First ladder, a maintenance contract that patches "within 30 days" is MANUAL against attackers who build their exploits with AI in hours: the deadline should be measured in hours and put in writing.
Frequently asked questions
Have websites already been breached via PHP2Shell?
There are no confirmed intrusions as of October 22, but there are millions of attempts and a working exploit already exists for PHP's recommended configuration.
From what date should I review my website?
From at least October 17, according to Amazon, even if you updated on October 21.
Is a web application firewall (WAF) enough?
It helps while you update, but Amazon stresses that only the new version of PHP fixes both flaws.