A frantic rush to secure the internet against critical flaws in the PHP scripting language proved to be a step behind for many organizations last week. While system administrators scrambled to apply emergency fixes on Wednesday, new evidence reveals that hackers had already discovered the holes and begun launching attacks days before the official warnings went live. The situation became so precarious that some government agencies chose to take their own websites offline entirely rather than risk being compromised during the window between discovery and patching.

Research released by Amazon Web Services shows that at least one attacker began probing for these vulnerabilities, dubbed PHP2Shell, as early as October 17. This breach occurred four days before the general public was notified of the danger. Analysts detected the early movement through honeypots, which are decoy servers designed to lure hackers and study their behavior. These initial attempts originated from anonymized networks often used by cybercriminals to mask their identity, leaving experts wondering how the flaw leaked before its scheduled disclosure.

Once the patches were officially released on Wednesday morning, the floodgates opened completely. Proof of concept exploits appeared almost instantly, with some surfacing just hours before the formal announcement. AWS reported a surge of diverse attack patterns hitting their sensors from multiple sources worldwide, suggesting that several different hacking groups were competing to weaponize the bug simultaneously. While it is still unclear if all these early attempts successfully breached real world systems, officials confirm that PHP2Shell is now being actively exploited across the web.

This incident highlights a growing crisis in cybersecurity known as shrinking lead times. According to CJ Moses, chief information security officer at AWS, artificial intelligence is fundamentally changing how hackers operate by allowing them to analyze code updates and create exploits in minutes rather than days. In previous years, most attackers waited for expert guides to be published before striking, but AI has lowered the barrier to entry. Now, even less skilled actors can rapidly turn a software fix into a roadmap for an attack, making traditional coordinated disclosure windows dangerously obsolete.