Two PHP vulnerabilities nicknamed “PHP2Shell” are being broadly exploited, according to Amazon, creating an urgent patching problem for organizations that operate PHP-based websites and servers.
The report describing the disclosure says PHP developers released security updates on Wednesday. The NSA advised every organization using PHP to update immediately—or take affected systems offline until they can be fully mitigated if prompt patching is not feasible.
The available report does not identify the affected PHP branches, vulnerable release numbers or fixed versions. It also provides no CVE identifiers, so administrators should not assume that a particular installation is safe solely because it is relatively recent.
Amazon saw an exploitation attempt before disclosure
Amazon said on Wednesday that it had detected an attempt to exploit the bug four days before the vulnerabilities became public. The company also described the flaws as being broadly exploited in the wild.
That account provides evidence of active exploitation, although the report does not attribute the activity to a particular attacker or quantify the number of targeted or compromised systems.
Researchers at US cybersecurity companies Calif and Wiz found the two vulnerabilities, which the report says had remained undetected for more than a decade. OpenAI and Google models assisted the research, while OpenAI, PHP, Calif and Wiz reportedly collaborated to validate the findings and prepare patches. Wiz is owned by Alphabet.
Successful attacks could expose servers and databases
The NSA warned that the flaws can often give attackers a direct route to a server’s file system or database. The UK’s National Cyber Security Centre said exploitation could allow an attacker to take control of a website server without supplying a password or other login credentials.
Those consequences could put website content, application files and database-backed services at risk, depending on how an affected server is configured. The report does not provide the vulnerabilities’ technical root causes or the precise prerequisites for exploitation.
Some European governments were reportedly taking websites offline while applying patches. In the United States, the White House said federal agencies were evaluating the possible effects on government networks and critical infrastructure.
PHP’s reach makes patch prioritization difficult
Wiz estimates that about 70 percent of websites worldwide use PHP. That figure describes PHP adoption, not the proportion of sites confirmed to run vulnerable versions.
WordPress is particularly relevant because the platform is written primarily in PHP and relies on the language to operate. However, the report does not establish that every WordPress site—or every PHP installation—is vulnerable.
Administrators should identify systems running PHP, prioritize exposed production servers and deploy the PHP security updates released on Wednesday. Where an affected system cannot be updated immediately, the NSA’s stated recommendation is to take it offline until full mitigation is possible. Because fixed version numbers are not specified in the report, teams should verify that the packages they deploy contain the PHP developers’ PHP2Shell corrections rather than relying only on operating-system update status.
OpenAI characterized the vulnerabilities as among the most consequential security findings in recent memory. It said frontier AI helped defenders discover them before attackers, while warning that the same capabilities could accelerate exploit development—an especially immediate concern now that Amazon has reported exploitation in the wild.
