Livestream Menu Make It select USA INTL Livestream Search quotes, news & videos Livestream Watchlist SIGN IN Create free account Markets Business Investing Tech Politics & Policy Video Watchlist Investing Club PRO Livestream Menu
The tech world is racing to implement fixes after the discovery of critical security vulnerabilities in software used to power much of the internet.
The software, known as PHP, is an open-source programming language widely used to power websites and web applications. The discovery of the flaws prompted urgent warnings from governments worldwide, while tech giants including Google, OpenAI and Amazon have been involved in efforts to uncover the vulnerabilities, detect potential attacks and protect affected systems.
The two vulnerabilities, collectively known as "PHP2Shell," could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers. While not every website using PHP is necessarily vulnerable, the software's widespread use has raised concerns about the potential scale of attacks.
The U.S. National Security Agency on Wednesday urged organizations using PHP to prepare security updates addressing the vulnerabilities, warning that the flaws could provide attackers with direct access to server file systems and databases. The agency recommended taking affected systems offline until the vulnerabilities are fully addressed if immediate updates are not possible.
The Federal Bureau of Investigation also warned that malicious actors could exploit the vulnerabilities to execute code remotely, putting sensitive data and networks at risk.
Cybersecurity authorities in Singapore , the United Kingdom , Australia , Canada and the European Union have issued similar alerts, underscoring concerns about the potential impact on businesses, government agencies and other organizations that rely on PHP-based systems.
Amazon said its threat intelligence team had detected attempts to exploit the vulnerabilities before they were publicly disclosed, using its MadPot threat detection system, which monitors suspicious activity across internet-facing infrastructure. It said the findings suggest malicious actors were already attempting to exploit the vulnerabilities. However, Amazon said it remains unclear how the attackers obtained information about the flaws ahead of their disclosure.
Meanwhile, Google and OpenAI highlighted the growing role of artificial intelligence in identifying and addressing cybersecurity threats. Google said its cybersecurity unit Wiz used AI models to help find and investigate the vulnerabilities, while its Gemini AI contributed to efforts to assess the flaws, test potential attacks and verify security patches.
OpenAI said researchers working with its AI models had also helped uncover critical vulnerabilities in PHP. The company said it had spent the past two months leading a coalition of software maintainers, cybersecurity researchers and security providers to coordinate fixes and prepare protective measures ahead of public disclosure.
The ChatGPT maker described the flaws as among the most significant security issues in recent memory, highlighting both the potential of advanced AI systems to identify vulnerabilities in widely used software and the risk that similar capabilities could be exploited by cybercriminals.
Cloudflare, which provides cybersecurity and website infrastructure services, said it had deployed…