Organizations must immediately install security patches addressing critical vulnerabilities in a programming language used by nearly 70 percent of the world’s websites, U.S. cybersecurity agencies have said.
The National Security Agency (NSA) said on Oct. 21 that organizations using PHP must update their systems immediately, warning that the vulnerabilities could let hackers take control of affected web servers.
The agency said it is seeking out the “malicious cyber actors” that may exploit these vulnerabilities, collectively nicknamed “PHP2Shell.”
“These risks are serious enough to require immediate patching across United States Government departments and agencies,” it said.
On the same day, the Cybersecurity and Infrastructure Security Agency (CISA) also issued an advisory urging organizations to install the security updates.
“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the agency said.
The NSA said that if organizations couldn’t install the updates immediately, they should consider taking affected systems offline until they could fully mitigate the vulnerabilities.
Some tech leaders have sounded the alarm.
Talking about PHP2Shell, Cloudflare co-founder and CEO Matthew Prince said in an Oct. 22 post on X that in the 10 hours before it was publicly announced, across the network “we saw thousands of attempts to exploit it.”
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” he said.
Shopify co-founder and CEO Tobias Lutke said in an Oct. 22 post on X that it was the “craziest day in cyber security in a long time.”
Developers of the PHP programming language, estimated to be used in about 70 percent of all websites, said on Oct. 20 that they had identified two critical vulnerabilities and stressed that users update their sites.
They announced earlier on Oct. 21 that a new version of the software that fixes the vulnerabilities is now live.
PHP is essentially the backbone of the web and powers many sites including WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many more.
The UK’s National Cyber Security Centre (NCSC), part of the intelligence agency GCHQ, urged UK organizations on Wednesday to prepare to immediately update systems using PHP.
“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the agency said.
In Japan, Prime Minister Sanae Takaichi similarly issued an urgent appeal for organizations to prepare to install the updates.
“We have an urgent request for everyone to take action tonight,” Takaichi wrote in an Oct. 21 post on X.
Government websites across Europe and elsewhere have been temporarily shut down as operators scrambled to protect systems against possible attacks.
Thirty-two UK government services were unavailable, and four were partially unavailable amid the PHP cybersecurity issue, UK tech minister Baroness Lloyd of Effra said in the House of Lords on Oct. 22.
French prefecture websites are currently down.
In the Netherlands, several government websites, including Overheid.nl, MijnOverheid.nl, DigiD, and its data protection authority, were taken offline.
In Denmark, the country’s national school communications platform Aula shut down on Oct. 22 because it was “addressing a potential technical security risk.”
OpenAI said that it helped to identify one of the vulnerabilities using its GPT‑5.6 Sol chatbot model.
In an Oct. 21 blog, it said that Calif, a California-based cybersecurity and AI-security company, identified the critical flaw.
Google-owned cloud cybersecurity company Wiz also contributed, saying it used AI bots such as Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol throughout this research.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” Wiz said in an Oct. 21 statement.
It said that the “underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.”
“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” it added.
Jack Phillips contributed to this report.
English (US) · 
Turkish (TR) · 