PHP Security Flaws: US NSA Urges Immediate Patching or Taking Servers Offline

Two critical PHP security vulnerabilities have triggered global warnings, with the US NSA urging organisations to patch affected systems immediately or disconnect vulnerable servers to prevent cyberattacks.

PHP Security Crisis: NSA Warns Organisations to Patch Vulnerabilities or Take Servers Offline

Two Critical PHP Vulnerabilities Trigger Global Cybersecurity Alert

The internet is facing a significant cybersecurity concern after researchers identified two critical vulnerabilities in PHP, a programming language used by a large proportion of websites worldwide. The flaws, collectively referred to as “PHP2Shell”, could allow attackers to gain control of vulnerable web servers without requiring prior access or authentication.

The US National Security Agency (NSA) has advised organisations to install the available security updates immediately. Systems that cannot be patched or adequately protected should be taken offline until the risks are addressed. The Federal Bureau of Investigation (FBI) has also issued a similar warning.

On October 21, 2026, the PHP Foundation released emergency security updates to address the vulnerabilities. The flaws reportedly remained undetected for more than a decade before researchers identified them using advanced artificial intelligence tools.

What Is PHP and Why Is It Important?

PHP, which stands for PHP: Hypertext Preprocessor, is an open-source programming language commonly used to build and operate websites. It processes information on web servers and helps generate the pages that users access through their browsers.

According to web technology tracker W3Techs, PHP powers nearly 70% of websites for which the programming language can be identified. Its widespread adoption means that security weaknesses in the language could affect numerous websites, online services and digital platforms, including sites built using WordPress.

Because PHP is maintained through an open-source development community, security updates are essential for website owners and administrators who rely on it.

How the PHP2Shell Vulnerabilities Could Affect Servers

The PHP2Shell vulnerabilities could allow attackers to execute commands on affected servers and potentially access files, databases and other sensitive resources. Successful exploitation could result in data theft, service disruptions, malware installation or further attacks against connected systems.

The NSA has warned that the flaws exist within PHP itself rather than being limited to individual applications or specific server configurations. Consequently, systems running vulnerable PHP versions may remain exposed even when the applications hosted on them have been configured correctly.

The PHP Foundation reportedly assigned the vulnerabilities a severity rating of 9.2 out of 10, indicating a critical security risk.

Dr Kanishk Agrawal, CEO of Path AI Technologies, told India Today Tech that vulnerabilities in PHP could affect multiple applications simultaneously, particularly when organisations use outdated software or expose vulnerable services to their networks.

NSA Advises Organisations to Patch or Disconnect Systems

The NSA has recommended that organisations prioritise installing the latest applicable security updates. Where immediate patching is not possible, the agency advises taking affected systems offline until effective mitigation measures can be implemented.

The recommendation highlights the seriousness of the threat, particularly for organisations operating public-facing websites, government services and platforms that handle sensitive information.

The PHP Foundation has released fixes for supported versions and advised users running older releases, including PHP 8.1 and earlier, to upgrade to a supported version. Organisations should verify which versions they operate and follow the official guidance applicable to their systems.

OpenAI Says Its AI Models Helped Discover the Flaws

OpenAI said its AI models contributed to discovering the vulnerabilities, describing the incident as one of the most impactful security issues in recent memory because of PHP's widespread use.

According to the report, the critical flaw was first identified by Calif.IO using GPT-5.6 Sol, while cybersecurity company Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the remediation effort, with support from OpenAI, Wiz, Cloudflare and other partners.

OpenAI said fixing the issues took approximately two months and required substantial changes to the PHP engine. It also released a PHP version checker as a Codex skill to help system operators identify potentially vulnerable installations.

Additionally, OpenAI announced a commitment of $1 billion in subsidised access intended to support organisations with limited security resources that protect essential services.

Countries and Public Services Take Precautionary Measures

The vulnerabilities have prompted international concern. Japan's Prime Minister Sanae Takaichi urged organisations to check their publicly accessible websites for PHP and apply the security updates as soon as possible. She also suggested temporarily suspending websites if fixes could not be installed promptly.

Public web services in Finland were temporarily shut down, while the Netherlands' cybersecurity agency took its website offline. Other affected services reportedly included the Dutch public health institute and the country's lower house of parliament.

The Wikimedia Foundation also took several systems offline as a precaution while preparing to apply the necessary fixes, temporarily affecting access to some Wikipedia services.

Cybersecurity agencies in the United Kingdom, European Union, Australia and Japan have urged users to install relevant security updates. CERT-EU warned that the vulnerabilities could affect PHP versions dating back to PHP 5, released in 2004.

Hackers Reportedly Attempted to Exploit the Vulnerabilities

Cybersecurity concerns intensified after information about the flaws reportedly circulated on social media ahead of the planned announcement, prompting the PHP Foundation to accelerate its disclosure.

Cloudflare CEO Matthew Prince said the company observed thousands of exploitation attempts before the vulnerabilities were publicly announced. He reported that the activity increased sharply after disclosure, reaching millions of attempts across the company's network.

Rajesh Chhabra, general manager at Acronis, warned that artificial intelligence is making it easier to discover security weaknesses but may also shorten the time attackers need to develop working exploits. He stressed that organisations must treat patching as an urgent operational priority.

Conclusion: Immediate Updates Are Essential

The PHP2Shell incident highlights the security risks associated with widely used software and outdated systems. Organisations should identify vulnerable PHP installations, apply the appropriate security updates, assess potential exposure and temporarily disconnect systems that cannot be protected. Prompt action can help reduce the risk of data theft, malware infections and wider network compromise.