Hackers got a four-day head start on the PHP2Shell vulnerability before it was even made public. Amazon, the world's largest cloud computing provider, said it identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public.
The flaws sit in a programming language that underpins much of the Internet. Amazon added that the vulnerabilities are "now being broadly exploited in the wild." Governments and companies are now rushing to secure their systems.
What Is the PHP2Shell Vulnerability and How Was It Found?
The PHP2Shell vulnerability is a set of flaws in a widely used programming language that much of the Internet depends on. What makes this case stand out is how the flaws were discovered: Amazon said they were found using AI tools.
That detail matters. AI tools are increasingly being used to hunt for security weaknesses, and in this case they surfaced flaws serious enough that attackers were already trying to use them before the public knew they existed.
Why the Four-Day Head Start Matters
The four-day gap between the first hacking attempt and public disclosure is the core of this story. In security terms, that window gave attackers time to work on exploiting the bug while defenders had no idea it existed.
Amazon's warning that the flaws are "now being broadly exploited in the wild" confirms that the head start was not wasted. The exploitation is no longer theoretical or limited — it is happening widely.
- Amazon spotted a hacking attempt four days before the PHP2Shell bug was disclosed
- The flaws were discovered using AI tools
- Amazon says the flaws are now being broadly exploited in the wild
- Governments and companies are rushing to secure their systems
Our Take: A Four-Day Gap Is a Warning for Everyone
To put it plainly, a four-day head start is not a small detail — it is the whole problem. If attackers are already probing a flaw before the public even knows it exists, then the usual disclosure process is running behind the people it is meant to protect.
In our view, the fact that AI tools found these flaws cuts both ways. It shows defenders have powerful new ways to spot weaknesses. But it also raises an uncomfortable question: if AI can find these bugs, attackers can use the same tools to find them first.
The most important takeaway for readers is simple. Amazon's warning that the flaws are "now being broadly exploited in the wild" means this is not a distant technical issue. Any organization running systems built on this language should treat the warning as urgent and act on it now, not after the next headline.
The four-day head start is a reminder that speed matters more than ever in security. When a bug is found with AI tools and exploited before disclosure, the gap between discovery and defense is where the real damage happens.