Probing of the PHP flaws started four days early

On October 22, 2026, at 11:25 a.m., Ars Technica published Tom Wilson and Rafe Rosner-Uddin, identified as Financial Times reporters. The headline calls the PHP flaws PHP2Shell. The photograph is the article's picture of a network switch and cables. The page credits Getty Images. What follows is the published result and the attributions. It does not include a way to exploit the flaws.

Amazon says it identified an attempt to exploit the bug four days before the weakness was disclosed to the public. Amazon also says the flaws are now being broadly exploited. The article says the US National Security Agency and UK authorities warned earlier the same Wednesday that the vulnerabilities had left websites critically exposed. Some European governments were reportedly taking sites offline while they patched. The article says reportedly, and it does not name those governments. The developers who maintain PHP released patches earlier that Wednesday. The NSA told organizations using PHP to update immediately or take systems offline.

Researchers at Calif and Wiz, two US security companies, discovered the vulnerabilities. Wiz, owned by Alphabet, estimated that the language powered about 70 percent of websites. That is Wiz's estimate. The article gives WordPress as a reason the language is so widespread: WordPress is written primarily in PHP and relies on it. The UK National Cyber Security Centre said the vulnerabilities could potentially allow control of a website's server without a password or other login credentials, and it encouraged UK organizations to act immediately. That is the centre's description of the impact.

OpenAI said the same day that, given the severity and PHP's widespread use, it considers this one of the most impactful security issues in recent memory. It also said that, to its knowledge, frontier AI found the vulnerabilities before attackers did. The next sentence is the lab's own warning: AI can uncover flaws with internet-scale impact, and the same capabilities can help attackers develop offensive tools faster. The article says OpenAI worked with PHP, Calif, and Wiz to verify the vulnerabilities and develop the patches. The White House said federal agencies were assessing the impact on government systems and critical infrastructure.

The two clocks should stay separate. Amazon is talking about probing four days before public disclosure, and about broad exploitation now. OpenAI is saying that, to its knowledge, frontier models found the flaws before attackers did. The page places both statements in the same story and does not say whether the four days of probing began before or after the labs found the bugs. The article also says the flaws had gone undetected for more than a decade when they were uncovered with the help of OpenAI and Google models. It does not give a start date for that decade, and it does not set out a procedure for how the models found the bugs.