Two critical PHP flaws put websites at risk as governments, including Australia's, issue urgent warnings

Two critical vulnerabilities, collectively called "PHP2Shell", have been found in PHP, an open-source programming language widely used to power websites and web applications. Researchers say the flaws could allow attackers to remotely run malicious code on affected servers, potentially exposing sensitive data. Not every website using PHP is necessarily vulnerable, but the software's broad use has raised concerns about the scale of possible attacks.

The US National Security Agency warned that the flaws could give attackers direct access to server file systems and databases. It urged organisations to prepare security updates and recommended taking affected systems offline until the vulnerabilities are fully addressed if immediate updates are not possible. The FBI also warned that the flaws put sensitive data and networks at risk. Cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada and the European Union have issued similar alerts. Google, OpenAI and Amazon have been involved in efforts to uncover the flaws, detect potential attacks and protect affected systems.

Amazon said its MadPot threat detection system spotted attempts to exploit the vulnerabilities before they were publicly disclosed, suggesting malicious actors were already active. It said it remains unclear how the attackers learned about the flaws ahead of disclosure.