GoKawiilPHP flaws dubbed 'PHP2Shell' trigger NSA, FBI warnings and big tech response
Security researchers identified two critical vulnerabilities in PHP, the widely used web programming language, that could let attackers remotely execute malicious code on servers. Google, OpenAI and Amazon have been involved in efforts to detect exploitation attempts and help secure affected systems, while the US NSA and FBI issued warnings urging organizations to patch or take vulnerable systems offline.
GoKawiil's interpretation of the reporting above, not reported fact.
PHP underlies a huge share of websites, blogs and online stores, so unpatched servers could give attackers broad access to sensitive data and file systems across many industries. Government warnings from the US, Singapore and the UK suggest officials view the exploitation risk as both severe and widespread, though the full scale of actual attacks remains unclear.
- Two PHP vulnerabilities, called PHP2Shell, allow remote code execution on servers.
- NSA and FBI urged urgent patching or taking systems offline as a precaution.
- Google, OpenAI and Amazon are among companies assisting with detection and mitigation.
Source: cnbc.com — Jenny Lee, 2026-10-22
Published there as: “Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.