Hackers began probing two critical PHP vulnerabilities four days before the flaws were publicly disclosed or patched, according to Amazon’s security chief, in a case that shows how attackers can learn about software bugs before the developers who need to fix them. The episode has prompted the US National Security Agency to advise organisations that cannot patch to take affected servers offline entirely.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution without any login, the most dangerous class of web vulnerability. They were discovered with the help of artificial intelligence by the security firms Calif and Wiz working with OpenAI, and the PHP Foundation shipped fixes on October 21. But Amazon’s CJ Moses said the company detected the first exploitation attempt against one of its decoy servers on October 17, four days earlier. How the attackers learned of the bugs before disclosure remains unknown.
Millions of servers exposed
The scale of potential exposure is enormous. The threat intelligence firm Dataminr estimates that more than 5.1 million internet-facing hosts run PHP, and while most observed activity so far appears to be scanning and non-working exploit attempts rather than confirmed break-ins, the window between first probe and patch gave attackers a genuine head start. Security teams are being urged to patch immediately and to review server logs going back to at least October 17 for signs of compromise.
The case is a landmark for AI-assisted vulnerability research. The PHP Foundation itself noted that artificial intelligence is accelerating flaw discovery on both sides: defenders finding and fixing bugs faster, but attackers potentially learning about them through the same channels. The four-day gap raises uncomfortable questions about how disclosure pipelines can leak, whether through shared research tools, chat logs or other channels that adversaries may monitor.
What to do now
The advice from officials is blunt. Patch every PHP installation without delay, hunt through logs for the indicators published with the disclosure, and if a system cannot be patched, disconnect it, as the NSA recommends. The first wave of attacks we reported earlier shows how quickly theoretical flaws become live threats. For the broader picture of how technology stories are colliding with geopolitics this week, see our earlier world desk coverage, and the security briefing tracking this incident as it develops.
