Race to update services' computer systems after cyber-security flaw found

Critical vulnerabilities, now named "php2shell," have been discovered in the programming language PHP, which powers an estimated 70% of the world's websites. These flaws, inherent in the language and affecting many past versions, allow unauthenticated attackers to remotely execute code on servers running PHP under certain conditions. Cyber-security firm Wiz helped uncover these vulnerabilities. The PHP Foundation, responsible for maintaining the language, has warned of the risks. In response to the discovery, websites have been taken offline, and some large organizations have reported a high volume of attempted breaches.

Singapore's Commissioner of Cybersecurity, Gwenda Fong, has urged organizations to immediately address two critical security flaws in the PHP programming language. These vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), affect all PHP versions and could allow hackers to gain server control, steal data, or disrupt services without credentials. Fong emphasized the immediate threat, noting that working exploits have been demonstrated and security patches were released on Wednesday. The Cyber Security Agency of Singapore (CSA) issued an alert on Wednesday, reporting widespread exploitation attempts and the development of proof-of-concept exploits. Cloudflare also reported millions of exploitation attempts following the public disclosure of these vulnerabilities.

Critical vulnerabilities, nicknamed PHP2Shell, have been discovered in the widely used PHP programming language, which powers over 70 percent of global websites. These flaws, found independently by cybersecurity companies Calif and Wiz with the help of AI, allow hackers to execute code on websites, potentially altering them or extracting sensitive data. Affecting PHP versions 5.4 and later, the vulnerabilities have prompted urgent updates from PHP developers. As a precaution, some European government websites and organizations, including the Dutch cybersecurity agency, have temporarily gone offline. An attempt to exploit these flaws was detected by Amazon's security team prior to their public disclosure, highlighting the immediate risks posed by these critical-level bugs.

Governments and companies worldwide are responding to the discovery of critical cyber-security flaws in the PHP programming language, which is used by a significant number of websites. The UK government is actively working to identify potential exposure in its online services, urging all organizations to follow guidance for system protection. Amazon reported experiencing multiple cyber-attack attempts before the vulnerabilities were publicly disclosed, though it remains unclear how attackers gained prior knowledge. The UK's National Cyber Security Centre, along with counterparts in the EU and Australia, has advised users of PHP to apply necessary fixes, suggesting systems be taken offline if immediate remediation is not possible. These flaws were initially identified by AI, prompting urgent calls for action to prevent exploitation by hackers.

A significant cybersecurity vulnerability in PHP, a programming language that powers numerous platforms including Wikipedia and WordPress, has triggered a global response. The flaw, which could allow attackers to gain unauthorized control of web servers and steal sensitive data, has left millions of websites exposed. AI may accelerate the exploitation of this vulnerability, according to cybersecurity experts. The alert has disrupted services worldwide, prompting organizations like Wikimedia to take precautionary measures by disabling some of their systems. The potential for malicious actors or nations to weaponize this flaw poses a significant risk to private data.