Cybersecurity Nightmare Day: PHP RCEs, AWS PHP2Shell, AI-Powered Bank Hacks
A cascade of critical security incidents hit simultaneously: PHP zero-days with active exploitation, AWS confirming PHP2Shell broadly exploited before public disclosure, Railway's platform compromise, and a report of AI agents (Claude and Grok) used to attack 400+ Latin American banks.
What we know
Beyond the Railway breach, today featured a broader cybersecurity meltdown. An account on X reported AWS confirming PHP2Shell is 'now being broadly exploited in the wild,' with the threat actor having acquired exploit information before public disclosure via a commercial anonymization network. Another account on X quoted a summary of the day's incidents: two critical unauthenticated PHP RCEs already being exploited, LiteLLM v1.107.0 vulnerabilities, and multiple supply chain compromises. Most alarming to financial markets: Another account on X flagged a report that hackers used Claude and Grok AI to automate attacks targeting over 400 banks and financial targets in Latin America — described as one of the first documented cases of AI agents autonomously stealing data and accessing bank accounts. Another account on X in the Essential CT feed also highlighted a separate scandal: an Indian certificate authority reportedly used private keys selected from the range 1–384 for 384-bit certificates.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.