Critical PHP flaws trigger urgent security updates worldwide

What This is

• Two critical PHP vulnerabilities, dubbed PHP2Shell, can let attackers run code on a web server without logging in and may expose sensitive data from server memory.
• Because PHP runs a large share of the web, reports estimate the flaws could affect about 70% of websites, including many WordPress-powered sites.
• National cyber agencies, including U.S. and U.K. authorities, urged urgent patching and said some unpatched systems should be taken offline or isolated.
• PHP developers released emergency security updates for supported PHP versions, and administrators were told to upgrade to fixed releases.
• Many organizations and governments temporarily took websites and online services offline while applying fixes, including public-sector sites in several countries.
• Cloud and security firms reported a rapid surge in scanning and exploit attempts to millions after the disclosure.
• Several reports say AI tools helped researchers identify and investigate the flaws.

Why This Matters

• A flaw in a common web building block can interrupt everyday services when governments and companies take sites offline as a precaution.
• Bugs that let unauthorized attackers run code on servers can turn trusted sites into entry points for theft, fraud, or wider network break-ins.
• AI can shrink the time between disclosure and working attacks, putting more pressure on fast updates, better monitoring, and safer defaults.
• The incident highlights how much the internet depends on open-source code that may be hard to locate and update across older systems.