Amazon says hackers targeted PHP flaw four days before it was made public
US and UK authorities urged organizations to patch two PHP vulnerabilities found with help from AI models, according to a report published by Ars Technica.
Hackers tried to exploit a serious flaw in the PHP programming language four days before the weakness was disclosed to the public, Amazon said on Wednesday. This is according to a Financial Times report republished by Ars Technica, the only source for this story.
Amazon, described in the report as the world's largest cloud computing provider, said the two flaws were "now being broadly exploited in the wild."
The developers who maintain PHP released software updates to fix the vulnerabilities earlier on Wednesday. On the same day, the US National Security Agency told all organizations using PHP to update their systems immediately or take them offline.
“These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”National Security Agency
The UK's National Cyber Security Centre said the flaws could allow a hacker to take control of a website's server without a password or other login credentials. The report said some European governments were reportedly taking sites offline while they patched.
The flaws matter because of how widely PHP is used. Wiz, an Alphabet-owned cybersecurity company, estimated that PHP powers about 70 percent of all websites in the world. According to the report, much of that reach comes from WordPress, the most widely used website-building platform, which is written primarily in PHP.
The bugs had gone undetected for more than a decade. Researchers at two US cybersecurity groups, Calif and Wiz, found them with help from OpenAI and Google models. OpenAI said it worked with PHP, Calif and Wiz to verify the flaws and develop the patches.
"To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI said. The company added that the same capabilities "can also help attackers rapidly develop offensive tools and exploits."
The report noted that new models released earlier this year by Anthropic and OpenAI with strong cyber capabilities drew warnings from politicians and financial regulators. They also led the US government to temporarily limit how widely the models were rolled out.
Much is still unclear. The report does not say who was behind the attempt Amazon detected before disclosure, how Amazon spotted it, or whether it succeeded. It also gives no figures on how many websites have been compromised and does not name the European governments said to have taken sites offline. The White House said federal agencies were assessing the possible impact on government systems and critical infrastructure.
