AI-Discovered PHP Flaws Exploited Before Public Disclosure, Amazon Warns

According to Amazon, hackers attempted to take advantage of two PHP vulnerabilities just four days prior to their public announcement. The company revealed on Wednesday that it had detected this early breach. The largest cloud computing provider in the world noted that these vulnerabilities are "now being broadly exploited in the wild." Discovered with the help of OpenAI and Google models after remaining unnoticed for over ten years, these flaws impact a programming language essential to much of the internet. On Wednesday, the US National Security Agency advised all organizations using PHP to either update their systems immediately or take them offline, while UK officials warned that websites globally were at critical risk; some European nations reportedly disabled sites during the patching process. Earlier that same day, PHP's maintainers issued software updates to address both vulnerabilities. This incident highlights how AI can disrupt cybersecurity: new models from Anthropic and OpenAI released earlier this year, equipped with advanced cyber capabilities, prompted warnings from politicians and financial regulators, leading the US government to temporarily restrict their deployment.