Security researchers have disclosed two critical vulnerabilities in PHP, the open-source language behind a large share of the web, warning that the flaws could let attackers run malicious code remotely on affected servers and reach sensitive data. The pair has been dubbed "PHP2Shell."

The U.S. National Security Agency urged organizations running PHP to prepare security updates, warning the flaws could give attackers direct access to server file systems and databases. Where immediate patching is not possible, the agency recommended taking affected systems offline until the issues are fully addressed. The FBI issued its own warning that malicious actors could exploit the flaws for remote code execution, putting data and networks at risk. Cybersecurity authorities in Singapore, the UK, Australia, Canada and the European Union issued similar alerts.

Amazon said its threat intelligence team had detected attempts to exploit the vulnerabilities before they were publicly disclosed, using its MadPot detection system, which monitors suspicious activity across internet-facing infrastructure. The company said it remains unclear how attackers learned of the flaws ahead of disclosure.

Google said its cybersecurity unit Wiz used AI models to help find and investigate the vulnerabilities, while its Gemini AI contributed to assessing the flaws, testing potential attacks and verifying patches. OpenAI said researchers working with its models also helped uncover critical vulnerabilities in PHP, and that it had spent the past two months leading a coalition of software maintainers, researchers and security providers to coordinate fixes and protective measures before public disclosure. The ChatGPT maker called the flaws among the most significant security issues in recent memory.

Cloudflare said it had deployed protections through its web application firewall to block malicious requests targeting affected systems while organizations install updates. The PHP development team has released security fixes, and authorities are urging operators to identify affected versions and apply them as quickly as possible.

Source: CNBC