Amazon said it detected attempts to exploit the newly disclosed "php2shell" vulnerabilities before the flaw was made public this week, while British officials said they were still working to identify the scale of the country's exposure a day after the disclosure triggered a global scramble to patch affected servers.
The acknowledgment from Amazon, one of the world's largest cloud infrastructure providers, suggests that some attackers may have had early knowledge of the flaw or independently discovered it before the coordinated public disclosure by the security firm Wiz. The company did not say whether any of its own systems were successfully compromised, only that attack attempts had been observed.
Britain's Scramble
In the UK, officials said they were working with government departments and critical infrastructure operators to identify which systems run vulnerable versions of PHP, after peer governments in the Netherlands, Finland, France and Australia opted to proactively take some services offline rather than risk exploitation. The scale of Britain's exposure remained unclear as of Thursday, though officials said the National Cyber Security Centre was treating the flaw as a top priority given PHP's widespread use across both public and private-sector websites in the country.
Security researchers have estimated that roughly 1.5 million internet-facing servers worldwide are still running vulnerable, unpatched versions of PHP, a figure that underscores how much work remains even as the PHP Foundation's emergency patches become available. The gap between patch availability and actual deployment is often where the real damage occurs in episodes like this one, security experts said, since many organizations running PHP on older infrastructure are slow to update even well-publicized, critical vulnerabilities.
What Comes Next
Cybersecurity agencies across multiple countries are continuing to monitor for signs of broader exploitation in the coming days, which experts consider the most dangerous window now that the vulnerability's existence and technical details are public knowledge. Amazon and other major cloud providers are expected to publish more detailed guidance for customers running PHP-based applications on their platforms in the coming days.