Global Tech Giants and Government Agencies Race to Contain Critical PHP Security Flaws

Technology giants, cybersecurity researchers, and government agencies worldwide have launched a coordinated response after two critical vulnerabilities were discovered in PHP, the widely used open-source programming language that powers a large share of websites and web applications globally.

The flaws, collectively dubbed "PHP2Shell," could let attackers remotely execute malicious code on affected servers, potentially opening the door to sensitive files, databases, and other critical systems, according to researchers involved in the disclosure. Because PHP is so deeply embedded in websites, enterprise applications, and online services, the findings have stirred concern across the cybersecurity community, with fears that successful exploitation could hit a significant number of internet-facing systems.

Amazon said its threat intelligence team detected attempts to exploit the vulnerabilities before details were made public, using its MadPot threat detection network—which monitors suspicious activity across internet-connected infrastructure—to spot signs of malicious activity targeting the flaws. The observations suggest threat actors may have known about the vulnerabilities before their public disclosure, though it remains unclear how they might have obtained that information in advance.

The incident has also spotlighted the growing role of artificial intelligence in cybersecurity research. Google said its cloud security unit, Wiz, used AI-powered systems to help identify and analyse the vulnerabilities. Its Gemini AI models were deployed to evaluate potential attack scenarios, assess the impact of the flaws, and help validate security patches developed to address the risks.

"PHP and Wiz Research disclosed two critical vulnerabilities in the core PHP language runtime that can expose applications to unauthenticated remote code execution and memory disclosure. Wiz used a mix of models to identify and help remediate these vulnerabilities," Google said.

OpenAI said researchers working alongside its AI models helped discover and investigate the vulnerabilities. The company said it spent the past two months coordinating a coalition of software maintainers, security vendors, and cybersecurity specialists to prepare fixes and mitigation measures before public disclosure, describing PHP2Shell as one of the most significant cybersecurity issues uncovered in recent years.

Government agencies have moved quickly to warn organisations about the threat. The US National Security Agency urged PHP users to identify affected systems and deploy security updates as soon as possible, warning that the vulnerabilities could give attackers direct access to server file systems and databases. The Federal Bureau of Investigation issued a similar warning, cautioning that attackers could use the flaws to gain remote control of servers and compromise sensitive information. Cybersecurity authorities in the United Kingdom, Singapore, Australia, Canada, and the European Union also released advisories urging organisations to act immediately.