US agencies urge fixes for programming language flaws putting millions of web systems at risk

The NSA, FBI and Cybersecurity and Infrastructure Security Agency urged organizations Wednesday to fix two critical flaws in software that powers much of the web, warning that systems should be taken offline if they cannot be secured promptly.

The vulnerabilities affect PHP, a programming language that works behind the scenes to run websites, process forms and retrieve information. Hackers could exploit the flaws in that software to run commands on an affected server without logging in, potentially allowing them to steal data, change a website’s contents or take control of it.

The scale of PHP’s use makes the warning highly significant. It runs on roughly 70% of websites whose underlying server-side programming language can be identified, according to web technology tracker W3Techs. Popular website-building platforms, including WordPress, Drupal and Joomla, rely on it.

Palo Alto Networks’ Unit 42 said its monitoring identified more than 22.6 million internet-exposed instances potentially vulnerable to the flaws. 

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the cyberdefense agency said in a blog post.

A Nextgov/FCW analysis using Shodan, a search engine that catalogs internet-connected systems, identified roughly 900 results associated with U.S. federal, state and local government websites that showed signs of PHP use. Many listed older versions of the software, though it’s unclear if the records reflect the versions currently running on those systems, as Shodan may not yet have captured recent updates.

Governments in Europe have already been taking some websites offline to implement fixes.

“I’d expect a great deal of opportunistic exploitation: attackers don’t need to know what’s vulnerable before they start knocking on doors,” said Trey Darley, the founder of ProperTools, a cybersecurity standards consultancy. “Meanwhile, defenders can’t reliably count what they need to patch and protect.”

“Right now, the priority is protecting the systems people actually have,” he added.

The U.S. government was involved in coordinating the response ahead of disclosure. OpenAI said it and its partners engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director and Cybersecurity and Infrastructure Security Agency to help security guidance reach organizations responsible for critical infrastructure and other essential services.

The flaws, collectively known as “php2shell,” affect the software beneath websites rather than a single website or application. That means an organization could have carefully secured its own code and still be exposed through the PHP software running it.

Cybersecurity company Wiz said it demonstrated successful attacks against WordPress, Drupal and Joomla installations. Researchers also showed they could read sensitive information from a server’s working memory, including passwords and access credentials.

PHP’s developers also said all installations handling web requests are at risk. Under certain setups, an attack can take place before the website’s own code even executes.

The discovery adds to evidence that AI is helping researchers find and exploit flaws in widely used software. OpenAI said security firm Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the development and release of fixes.

PHP’s developers released updates Wednesday for supported versions of the software. They said organizations using Linux distributions or long-term support services should check their vendors for updated packages, including fixes adapted for older versions.

The warnings followed an early leak that accelerated plans to disclose and fix the vulnerabilities. A post on the technology forum Hacker News surfaced Tuesday morning and was subsequently removed, but screenshots spread across social media, according to cybersecurity firm Huntress. PHP’s developers then announced that fixes would arrive a day ahead of the planned disclosure, leaving website operators little time to prepare for updates.

Editor’s note: This story is breaking and may be updated.