As of publication, CISA had not yet observed exploitation of the flaws, even as it urged immediate patching. The bugs are older than the current fix: researchers flagged a related problem in 2024 that went unaddressed, and a partial fix in 2020 followed a separate report. Whether the attacks have spread beyond the early activity Amazon and Cloudflare recorded is not yet clear. The number of affected servers still unpatched is also unknown.
For attorneys, the window is narrow. The patch and disclosure landed the same week exploitation began, so clients running PHP need to confirm they are on a fixed version now. The FBI advises taking systems offline if an immediate update is not possible, and the UK's NCSC has issued similar guidance. Watch for a CISA exploitation advisory, which would shift breach-notification and duty-of-care analysis. Experts warn that other AI-discovered flaws likely remain unfound, so clients should expect pressure to audit legacy code, not just patch this one issue.