The tech world is racing to implement fixes after the discovery of critical security vulnerabilities in software used to power much of the internet.
The software, known as PHP, is an open-source programming language widely used to power websites and web applications. The discovery of the flaws prompted urgent warnings from governments worldwide, while tech giants including Google, OpenAI and Amazon have been involved in efforts to uncover the vulnerabilities, detect potential attacks and protect affected systems.
The two vulnerabilities, collectively known as "PHP2Shell," could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers. While not every website using PHP is necessarily vulnerable, the software's widespread use has raised concerns about the potential scale of attacks.
The U.S. National Security Agency on Wednesday urged organizations using PHP to prepare security updates addressing the vulnerabilities, warning that the flaws could provide attackers with direct access to server file systems and databases. The agency recommended taking affected systems offline until the vulnerabilities are fully addressed if immediate updates are not possible.
The Federal Bureau of Investigation also warned that malicious actors could exploit the vulnerabilities to execute code remotely, putting sensitive data and networks at risk.
Cybersecurity authorities in Singapore , the United Kingdom , Australia , Canada and the European Union have issued similar alerts, underscoring concerns about the potential impact on businesses, government agencies and other organizations that rely on PHP-based systems.
Amazon said its threat intelligence team had detected attempts to exploit the vulnerabilities before they were publicly disclosed, using its MadPot threat detection system, which monitors suspicious activity across internet-facing infrastructure. It said the findings suggest malicious actors were already attempting to exploit the vulnerabilities. However, Amazon said it remains unclear how the attackers obtained information about the flaws ahead of their disclosure.
Meanwhile, Google and OpenAI highlighted the growing role of artificial intelligence in identifying and addressing cybersecurity threats. Google said its cybersecurity unit Wiz used AI models to help find and investigate the vulnerabilities, while its Gemini AI contributed to efforts to assess the flaws, test potential attacks and verify security patches.
OpenAI said researchers working with its AI models had also helped uncover critical vulnerabilities in PHP. The company said it had spent the past two months leading a coalition of software maintainers, cybersecurity researchers and security providers to coordinate fixes and prepare protective measures ahead of public disclosure.
The ChatGPT maker described the flaws as among the most significant security issues in recent memory, highlighting both the potential of advanced AI systems to identify vulnerabilities in widely used software and the risk that similar capabilities could be exploited by cybercriminals.
Cloudflare, which provides cybersecurity and website infrastructure services, said it had deployed protections against the PHP2Shell vulnerabilities through its web application firewall. The company said its measures were designed to help block malicious requests targeting affected systems, providing an additional layer of defense as organizations work to install software updates.
The PHP development team has released security fixes, with authorities urging website operators to identify affected versions and apply the updates as quickly as possible. The episode underscores how vulnerabilities in widely used software can pose risks across industries and borders, even as AI increasingly plays a role in helping security researchers uncover and address those weaknesses.
