PHP2Shell vulnerability: ‘Most significant security issues…,’ How Google, OpenAI and Amazon respond to the cyber threat
The discovery of critical security vulnerabilities in PHP, an open-source programming language widely used to power websites and web applications, has prompted an urgent response from technology companies, cybersecurity researchers and government agencies. Google, OpenAI and Amazon have been involved in efforts to uncover the flaws, detect potential attacks and protect affected systems.
The two vulnerabilities, collectively known as “PHP2Shell,” could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers. The software’s widespread use has raised concerns about the potential scale of attacks.
Amazon said its threat intelligence team had detected attempts to exploit the vulnerabilities before they were publicly disclosed. The team used its MadPot threat detection system, which monitors suspicious activity across internet-facing infrastructure.
The company said the findings suggested malicious actors were already attempting to exploit the vulnerabilities. However, Amazon said “it remains unclear how the attackers obtained information about the flaws ahead of their disclosure.”
Google pointed out the growing role of artificial intelligence in identifying and addressing cybersecurity threats. The company said its cybersecurity unit, Wiz, used AI models to help find and investigate the vulnerabilities.
Google’s Gemini AI also contributed to efforts to “assess the flaws, test potential attacks and verify security patches.”
These efforts formed part of a broader response to the vulnerabilities, as technology companies and security researchers worked to identify risks and protect affected systems.
OpenAI said researchers working with its AI models had also helped uncover critical vulnerabilities in PHP.
The company said it had spent the past two months leading a coalition of software maintainers, cybersecurity researchers and security providers to coordinate fixes and prepare protective measures ahead of public disclosure.
The ChatGPT maker described the flaws as “among the most significant security issues in recent memory.”
The response extended beyond the three technology companies. The US National Security Agency urged organisations using PHP to prepare security updates, warning that the flaws could provide attackers with direct access to server file systems and databases. It recommended taking affected systems offline if immediate updates were not possible.
The Federal Bureau of Investigation also warned that malicious actors could exploit the vulnerabilities to execute code remotely, putting sensitive data and networks at risk. Authorities in Singapore, the United Kingdom, Australia, Canada and the European Union issued similar alerts.
Cloudflare said it had deployed protections against PHP2Shell through its web application firewall, designed to help block malicious requests targeting affected systems.
The PHP development team has released security fixes, with authorities urging website operators to identify affected versions and apply updates as quickly as possible.
Sanchari Ghosh is an Assistant Editor at Mint with over 12 years of experience in journalism, specialising in personal finance, DLT & DeFi, geopolitics and foreign policy, with a particular emphasis on how these areas intersect. <br> She writes extensively about how money works in everyday life—helping readers navigate personal finance decisions. <br> As AI reshapes investing behaviour, capital is increasingly flowing into decentralized ecosystems, redefining how assets are managed, traded, and valued. She focuses on explaining how money flows within frameworks like Distributed Ledger Technology (DLT), DeFi protocols, and crypto markets—while also exploring what the future of money could look like in a trustless, programmable financial world. <br> She also focuses on immigration-related issues, simplifying complex topics around visas, passports, overseas financial planning, and the many practical challenges Indians face while moving or living abroad. <br> Alongside personal finance, Sanchari has a strong understanding of international politics, contemporary and historical conflicts, and global state decisions. She closely tracks how geopolitical developments influence economies, markets, and individual financial choices, bringing together finance and global affairs in her reporting. <br> She began her career as a desk editor, which gave her a strong foundation in news writing. Over time, her interest naturally shifted toward personal finance. Before joining Mint in 2020, she worked DNA, The Times of India, Outlook Money, BloombergQuint, and ETMoney. At Mint, she got an opportunity to expand her coverage to include immigration and geopolitical developments while continuing to closely follow personal finance trends and market movements.As a journalist, she is committed to accuracy, intellectual rigour, and fairness. <br> She is an English Major and her work took her across cities including Delhi, Mumbai, and Pune. Living independently from an early age gave her firsthand experience in managing life and money on her own. This practical exposure sparked her strong interest in personal finance. <br> Outside the newsroom, Sanchari is a sports enthusiast who regularly plays lawn tennis and squash. In her younger years, she was also a national-level badminton player.
Catch all the Business News , Corporate news , Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.
More
✕
Wait for it…
Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.