The PHP development team said two vulnerabilities collectively known as "PHP2Shell" could allow hackers to remotely execute malicious code on affected servers, potentially leading to sensitive data leaks. Upgrading is the only secure option. If immediate updates cannot be completed, affected systems should be temporarily taken offline until the vulnerabilities are fully remediated.

Following the discovery of the vulnerabilities, governments worldwide issued urgent warnings. The US National Security Agency urged organizations using PHP to prepare for installation of security updates addressing the vulnerabilities, warning that attackers could directly access server file systems and databases. If immediate updates cannot be completed, affected systems should be temporarily taken offline until the vulnerabilities are fully remediated.

Cybersecurity agencies in Singapore, the UK, Australia, Canada and the European Union also issued similar alerts, reflecting market concerns that the vulnerabilities could affect enterprises, government departments and other organizations relying on PHP systems. The European Commission's cybersecurity division also warned that systems should be disconnected from networks if remediation cannot be completed. The Finnish government announced that it had taken public-facing websites offline. Japanese Prime Minister Sanae Takaichi said temporarily shutting down websites could also be an effective measure to reduce risks if timely responses prove difficult.

In addition, technology giants including Google, OpenAI and Amazon.com, Inc. (AMZN.US) participated in efforts to disclose the vulnerabilities, detect potential attacks and protect affected systems. Google said its cybersecurity unit Wiz used AI models to help identify and investigate the vulnerabilities, while Gemini AI also participated in vulnerability assessment, potential attack testing and security patch verification.

OpenAI said researchers using its AI models also helped identify critical vulnerabilities in PHP. Over the past two months, the company has led an alliance of software maintainers, cybersecurity researchers and security service providers to coordinate remediation work and prepare protective measures before public disclosure of the vulnerabilities.

Cloudflare, which provides cybersecurity and website infrastructure services, said it has deployed protective measures against the PHP2Shell vulnerabilities through its web application firewall. The measures are designed to block malicious requests targeting affected systems and provide additional protection while organizations install software updates.

In addition, Tencent Cloud announced that its Security Center had detected disclosed remote code execution vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619 under the codename "PHP2Shell". The vulnerabilities could allow unauthenticated remote attackers to trigger memory corruption and ultimately achieve remote code execution by sending specially crafted multipart POST requests, thereby gaining full control of servers. Tencent Cloud Security advised users to conduct security checks promptly and install updates immediately if affected to avoid external intrusions. (jl/)(Real-time Streaming US Stocks Quote; Except All OTC quotes are at least 15 minutes delayed.)