To answer the original question, Anytype doesn’t use PHP. We favour memory-safe languages such as Go, which we use for our sync infrastructure.
We apply security updates as quickly as possible. With new vulnerabilities turning up all the time, we also design Anytype and any-sync protocol to limit what a single breach could expose. Your data is encrypted before it leaves your device, and the keys stay with you and the people you share with. How Any-Sync works
Even if someone got into our sync servers through an unknown vulnerability, they’d find encrypted data and some technical metadata. Server access alone wouldn’t let them read your notes, files or messages.
On Amazon and Google: AnySync supports S3-compatible storage, including AWS S3, as well as fully self-hosted storage. Self-hosting docs.
Whichever provider you choose, the same protection applies: your content is encrypted before it leaves your device, and backup nodes don’t have the keys to read it. Hosting those nodes on AWS or Google doesn’t give either provider access to your readable content.
Using AWS alone wouldn’t tell us whether a self-hosted setup was affected. That depends on the software it runs and whether the relevant patches were applied
Update:
As you also mentioned the security audit, here’s the link to the recent post with the details of the audit we conducted with the Cure53 team.