tech
CERT-In Flags Global PHP Security Vulnerabilities
CERT-In flagged global PHP security vulnerabilities that allow unauthenticated attackers to execute malicious code remotely.
Key points
- The PHP2Shell vulnerabilities could allow hackers to remotely execute malicious code and access server file systems and databases.
- Tech companies including Google, OpenAI and Amazon are working to detect potential attacks and protect affected systems.
- The U.S. National Security Agency has urged organizations using PHP to prepare security updates to address the flaws.
Why it matters. The widespread use of PHP means blogs, online stores, and news portals worldwide could be targets for attackers to expose sensitive data.
CERT-In issued a critical-severity warning on Wednesday regarding two PHP vulnerabilities that allow remote malicious code execution. Google Cloud executives Chris Betz and Raluca Ada Popa stated that AI models helped identify these flaws, which Wiz Research also disclosed. Cloudflare CEO Matthew Prince reported thousands of exploit attempts in the 10 hours before the public announcement.
Latest updates
CERT-In Flags Global PHP Security Vulnerabilities
CERT-In has issued a warning regarding security vulnerabilities in PHP that have leaked online. The flaws have triggered a global scramble as governments and businesses work to patch their systems to prevent exploits. The vulnerabilities affect a wide range of web applications that rely on the PHP programming language. Authorities are urging immediate updates to secure digital infrastructure.
AI Tools Help Researchers Uncover Critical PHP Security Flaws
Researchers utilized AI tools to uncover critical security vulnerabilities in PHP, raising concerns about the dual role of AI in both cybersecurity and hacking. The flaws could allow unauthorized actors to execute malicious commands on a large share of the world's websites. Government agencies and operators are currently installing patches or taking vulnerable services offline as a precaution. This event highlights how AI is transforming the speed at which software weaknesses are discovered. The international response remains ongoing as fixes are rolled out.
Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond
Critical PHP security flaws trigger global warnings as Google, OpenAI and Amazon respond to potential cyber threats. 21 October 2026, Baden-Württemberg, Stuttgart: When visiting the website of the Baden-Württemberg Ministry of the Interior, a warning message appears in the browser indicating a potential security issue. A serious security vulnerability is threatening websites worldwide; blogs, online stores, and news portals could become targets for attackers. The PHP vulnerability allows attackers to take over entire servers. Photo: Bernd Weißbrod/dpa (Photo by Bernd Weißbrod/picture alliance via Getty Images) Picture Alliance | Picture Alliance | Getty Images The tech world is racing to implement fixes after the discovery of critical security vulnerabilities in software used to power much of the internet. The software, known as PHP, is an open-source programming language widely used to power websites and web applications. The discovery of the flaws prompted urgent warnings from governments worldwide, while tech giants including Google, OpenAI and Amazon have been involved in efforts to uncover the vulnerabilities, detect potential attacks and protect affected systems. The two vulnerabilities, collectively known as "PHP2Shell," could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers.
Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond
Critical PHP security flaws trigger global warnings as Google, OpenAI and Amazon respond to potential cyber threats. 21 October 2026, Baden-Württemberg, Stuttgart: When visiting the website of the Baden-Württemberg Ministry of the Interior, a warning message appears in the browser indicating a potential security issue. A serious security vulnerability is threatening websites worldwide; blogs, online stores, and news portals could become targets for attackers. The PHP vulnerability allows attackers to take over entire servers. Photo: Bernd Weißbrod/dpa (Photo by Bernd Weißbrod/picture alliance via Getty Images) Picture Alliance | Picture Alliance | Getty Images The tech world is racing to implement fixes after the discovery of critical security vulnerabilities in software used to power much of the internet. The software, known as PHP, is an open-source programming language widely used to power websites and web applications. The discovery of the flaws prompted urgent warnings from governments worldwide, while tech giants including Google, OpenAI and Amazon have been involved in efforts to uncover the vulnerabilities, detect potential attacks and protect affected systems. The two vulnerabilities, collectively known as "PHP2Shell," could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers.
Google And Amazon Respond To Critical PHP Security Flaws
A serious security vulnerability in PHP is triggering global alarms, potentially allowing attackers to target a wide range of websites. The flaw affects blogs, news portals, and e-commerce sites worldwide. Tech giants Google, OpenAI, and Amazon have responded to the threats. In Germany, the Baden-Württemberg Ministry of the Interior's website has already displayed browser warnings regarding the issue.
Critical PHP Security Flaws Trigger Global Alerts
A serious security vulnerability in PHP has sparked global alarms, potentially exposing blogs and e-commerce sites to cyberattacks. Google, OpenAI, and Amazon have issued responses to mitigate the threat. The flaw allows attackers to compromise web infrastructure, as evidenced by warning messages appearing on government sites in Germany.
Governments and businesses take sites offline to fix critical PHP security flaws
Global cybersecurity authorities and digital infrastructure operators have scrambled to address two critical security vulnerabilities discovered within the PHP programming language, which underpins roughly 70 percent of all websites worldwide. Numerous government bodies, municipal councils, universities, and private enterprises elected to take their web portals offline as an emergency precaution following alerts from security researchers actively tracking active exploitation by cyber criminals. The software flaws, identified earlier in the week, represent a major threat to digital architecture due to the widespread dependency on PHP across public and private sector networks. A security patch and software update were released by developers on Wednesday, prompting system administrators globally to apply emergency fixes and review network logs for unauthorized access. Cybersecurity agencies have urged all website operators using the affected programming language to verify installations and maintain high alert status as researchers fear a wider wave of targeted attacks. Further updates regarding remediation timelines and the full scope of the disruption are expected from international computer emergency response teams.