The tech industry is scrambling to implement fixes after major security vulnerabilities were discovered in the software that powers much of the internet.
This software, known as PHP, is an open-source programming language that is widely used to power websites and web applications. The discovery of this flaw prompted governments around the world to issue emergency alerts, while leading technology companies such as Google, OpenAI, and Amazon worked to uncover the vulnerability, detect potential attacks, and protect affected systems.
The two vulnerabilities, collectively known as PHP2Shell, could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, cybersecurity researchers said. While not all websites that use PHP are necessarily vulnerable, the software’s widespread use has raised concerns about the scale of potential attacks.
The National Security Agency on Wednesday urged organizations using PHP to prepare security updates to address the vulnerability, warning that the flaw could allow attackers direct access to a server’s file system or database. If an immediate update is not possible, the agency recommended that affected systems be taken offline until the vulnerability is fully resolved.
The Federal Bureau of Investigation also warned that a malicious attacker could exploit this vulnerability to remotely execute code and compromise sensitive data or networks.
Cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada, and the European Union have issued similar warnings, highlighting concerns about the potential impact on businesses, government agencies, and other organizations that rely on PHP-based systems.
Amazon said its threat intelligence team used its MadPot threat detection system, which monitors suspicious activity across internet-connected infrastructure, to detect attempts to exploit the vulnerabilities before they were made public. The company said the findings suggest that malicious attackers were already attempting to exploit the vulnerability. But Amazon said it remains unclear how the attackers obtained information about the flaw before it was made public.
Meanwhile, Google and OpenAI highlighted the growing role of artificial intelligence in identifying and addressing cybersecurity threats. Google said its cybersecurity division, Wiz, used AI models to help discover and investigate vulnerabilities, and Gemini AI helped assess flaws, test potential attacks, and validate security patches.
OpenAI said researchers using its AI models also helped discover critical vulnerabilities in PHP. The company said it has spent the past two months leading a coalition of software maintainers, cybersecurity researchers, and security providers to coordinate fixes and prepare safeguards ahead of public release.
ChatGPT’s creators described this flaw as one of the most significant security issues in recent memory, highlighting both the potential for advanced AI systems to identify vulnerabilities in widely used software and the risk that similar features could be exploited by cybercriminals.
Cloudflare, a provider of cybersecurity and website infrastructure services, said it has introduced protection against the PHP2Shell vulnerability through its web application firewall. The company said its countermeasures are designed to block malicious requests targeting affected systems and provide an additional layer of defense as organizations work to install software updates.
PHP development teams have released security fixes, and authorities are urging website operators to identify affected versions and apply updates as soon as possible. This episode highlights that despite the increasing role of AI in helping security researchers discover and address vulnerabilities, vulnerabilities in widely used software can pose risks across industries and borders.
