Governments worldwide are urging organizations to patch critical security flaws in PHP, the open-source programming language that powers much of the internet, after researchers found the vulnerabilities could let attackers remotely execute malicious code on affected servers. The two flaws, collectively known as PHP2Shell, prompted alerts from U.S., UK, Singapore, Australian, Canadian and EU cybersecurity authorities, and drew responses from Google, OpenAI, Amazon and Cloudflare.
The PHP development team has released security fixes for two critical vulnerabilities in the language, widely used to power websites and web applications. Cybersecurity researchers say the flaws, together known as PHP2Shell, could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data. Not every site running PHP is necessarily vulnerable, but the language's widespread use has raised concerns about the scale of potential attacks.
The U.S. National Security Agency on Wednesday urged organizations using PHP to prepare security updates, warning that the flaws could provide attackers with direct access to server file systems and databases. The agency recommended taking affected systems offline until the vulnerabilities are fully addressed if immediate updates are not possible. The FBI separately warned that malicious actors could exploit the flaws to execute code remotely, putting sensitive data and networks at risk. Cyber authorities in Singapore, the UK, Australia, Canada and the European Union issued similar alerts.
Amazon said its threat intelligence team had detected attempts to exploit the vulnerabilities before they were publicly disclosed, using its MadPot threat detection system, which monitors suspicious activity across internet-facing infrastructure. The company said the findings suggest malicious actors were already attempting to exploit the flaws, though it remains unclear how they learned of them ahead of disclosure.
Google and OpenAI highlighted the growing role of artificial intelligence in identifying and responding to such threats. Google said its cybersecurity unit Wiz used AI models to help find and investigate the vulnerabilities, while its Gemini AI contributed to assessing the flaws, testing potential attacks and verifying security patches. OpenAI said researchers working with its AI models had helped uncover critical vulnerabilities in PHP, and that it had spent the past two months leading a coalition of software maintainers, cybersecurity researchers and security providers to coordinate fixes before public disclosure. The company described the flaws as among the most significant security issues in recent memory, while noting the risk that similar AI capabilities could be exploited by cybercriminals.
Cloudflare said it had deployed protections against PHP2Shell through its web application firewall, designed to block malicious requests targeting affected systems and providing an extra layer of defense while organizations install updates. Authorities are urging website operators to identify affected versions of PHP and apply the fixes as quickly as possible.
Analysis
Why This Matters
- PHP underpins a large share of the world's websites, so a remote-code-execution flaw in it creates a broad attack surface for malicious actors.
- Amazon's detection of attempted exploitation before public disclosure indicates attackers were already moving against the vulnerable systems.
- The episode shows AI working on both sides of the security fight: helping defenders find and fix bugs while raising the risk that similar capabilities fall into criminal hands.
Background
PHP is an open-source, server-side scripting language used to build websites and web applications, and it forms the foundation of many content management systems. Because it runs behind a large portion of the internet, flaws in the language can ripple across industries and borders at once. Open-source security fixes are typically coordinated among maintainers, researchers and major technology companies before public disclosure, and this case appears to have involved an unusually large coalition organized over several months.
Key Perspectives
Security agencies: The NSA, FBI and authorities in Singapore, the UK, Australia, Canada and the EU are treating the flaws as urgent, calling for immediate patching and, where necessary, taking systems offline.
Tech companies: Google, OpenAI, Amazon and Cloudflare emphasize the role of AI-assisted research and early threat detection in finding the flaws and preparing defenses, with OpenAI describing the vulnerabilities as among the most significant in recent memory.
Critics and skeptics: The disclosure leaves open questions, including how attackers obtained knowledge of the flaws before they were announced. More broadly, the episode underscores the risk that AI tools capable of discovering vulnerabilities could be turned to offensive use, and that the speed of patching across the wider web may lag behind the speed of discovery.
What to Watch
- How quickly website operators worldwide apply the PHP security patches, and whether unpatched systems come under attack in the coming days.
- Any further reporting on how attackers learned of the flaws ahead of public disclosure.
- Whether this coordinated, AI-heavy disclosure model becomes standard practice for critical open-source vulnerabilities.
