Severe PHP web security vulnerabilities trigger global alert, Google, OpenAI and Amazon join response

Two severe vulnerabilities were found in PHP (collectively called PHP2Shell) that could allow attackers to remotely execute malicious code on affected servers. The US National Security Agency (NSA), the FBI, and agencies in Singapore, the UK, Australia, Canada and the EU issued alerts, and the NSA advised organizations unable to update immediately to take affected systems offline. Amazon said its MadPot threat detection system had detected exploitation attempts before the vulnerabilities were public, but how attackers learned of the vulnerabilities in advance is unclear. Google said its cybersecurity unit Wiz used AI models to help discover and investigate the vulnerabilities, with Gemini AI participating in assessing the vulnerabilities, testing attacks and validating patches; OpenAI said researchers and its AI models helped discover the vulnerabilities and led a coalition to coordinate fixes during the two months before public disclosure. Cloudflare has deployed protections against PHP2Shell through its web application firewall, and the PHP development team has released security fixes.