Critical PHP bugs send websites offline as Amazon reports broad exploitation

Two critical bugs in PHP, a decades-old programming layer behind a large share of the web, have set off a rapid patching scramble. The bugs can let an outsider send a specially crafted request and run code on a vulnerable server before the site’s own login or security checks get involved—opening a path to data theft or a full takeover. Some organizations temporarily took websites offline rather than leave them exposed, while PHP released emergency updates. The urgency rose after Amazon said it had seen exploitation attempts even before disclosure and now considers the flaws broadly exploited; researchers used AI to help uncover them, a sign that the gap between finding a serious weakness and attackers weaponizing it is narrowing.