Amazon says attackers used the PHP2Shell flaws on October 17, four days before anyone was told. Websites built on PHP are the concern.
Attackers were already using a set of serious website bugs, called PHP2Shell, four days before the public heard about them. Amazon Web Services says it saw the first attempts on October 17. The flaws were made public on October 21. At least one attacker had a head start.
The feed text says Amazon logged attempts to use the PHP2Shell bugs several days before the warning went out. It also describes the bugs as now being used broadly, though the wording is cut off in the material available. Amazon's analysts say at least one actor was behind the early attacks. Most website owners had no chance to prepare.
PHP is a common tool that runs behind many websites. That means plenty of businesses could be affected, often without knowing it. If your site was built by an agency or sits with a web host, the people who look after it are the ones who can answer the question. If you do not run a website, there is nothing here for you to do.
The material does not say exactly how the bugs work, which PHP versions or products are affected, or whether fixes are available. It also does not say who the attackers are or how many sites have been hit. Those details matter, and they may come out in the coming days.
The alert box above lists the steps. The short version is to ask your web host or IT provider whether your sites are exposed, and make sure any fix gets installed once it is released.
Expect hosts and software makers to publish guidance. Because attacks began before the warning, checking for signs of earlier trouble is as important as updating.
If your business website runs on PHP, ask your host or IT provider today whether PHP2Shell affects it and whether it is updated.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
