Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond

21 October 2026, Baden-Württemberg, Stuttgart: When visiting the website of the Baden-Württemberg Ministry of the Interior, a warning message appears in the browser indicating a potential security issue. A serious security vulnerability is threatening websites worldwide; blogs, online stores, and news portals could become targets for attackers. The PHP vulnerability allows attackers to take over entire servers. Photo: Bernd Weißbrod/dpa (Photo by Bernd Weißbrod/picture alliance via Getty Images)

Picture Alliance | Picture Alliance | Getty Images

The tech world is racing to implement fixes after the discovery of critical security vulnerabilities in software used to power much of the internet.

The software, known as PHP, is an open-source programming language widely used to power websites and web applications. The discovery of the flaws prompted urgent warnings from governments worldwide, while tech giants including Google, OpenAI and Amazon have been involved in efforts to uncover the vulnerabilities, detect potential attacks and protect affected systems.

The two vulnerabilities, collectively known as "PHP2Shell," could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers. While not every website using PHP is necessarily vulnerable, the software's widespread use has raised concerns about the potential scale of attacks.

The U.S. National Security Agency on Wednesday urged organizations using PHP to prepare security updates addressing the vulnerabilities, warning that the flaws could provide attackers with direct access to server file systems and databases. The agency recommended taking affected systems offline until the vulnerabilities are fully addressed if immediate updates are not possible.

The Federal Bureau of Investigation also warned that malicious actors could exploit the vulnerabilities to execute code remotely, putting sensitive data and networks at risk.