Google, OpenAI, and Amazon respond as critical PHP flaws spark global alarm

Tech giants and governments worldwide issued urgent security warnings on Wednesday following the discovery of critical vulnerabilities in PHP—flaws that went undetected for years until they were recently uncovered using artificial intelligence.

Developers of the PHP programming language on Wednesday released urgent new fixes, to vulnerabilities that had been lurking ‌in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."

The software, known as PHP, is an open-source programming language widely used to power websites and web applications. Google (GOOG), OpenAI (OPENAI) and Amazon (AMZN) have been involved in efforts to uncover the vulnerabilities, detect potential attacks and protect affected systems.

The two vulnerabilities, collectively known as “PHP2Shell,” could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers. While not every website using PHP is necessarily vulnerable, the software’s widespread use has raised concerns about the potential scale of attacks.

The U.S. National Security Agency on Wednesday urged organizations using PHP to prepare security updates addressing the vulnerabilities, warning that the flaws could provide attackers with direct access to server file systems and databases. The agency recommended taking affected systems offline until the vulnerabilities are fully addressed if immediate updates are not possible.

The Federal Bureau of Investigation also warned that malicious actors could exploit the vulnerabilities to execute code remotely, putting sensitive data and networks at risk.

Amazon (AMZN) said its threat intelligence team had detected attempts to exploit the vulnerabilities before they were publicly disclosed, using its MadPot threat detection system. It said the findings suggest malicious actors were already attempting to exploit the vulnerabilities. However, Amazon said it remains unclear how the attackers obtained information about the flaws ahead of their disclosure.

Meanwhile, Google (GOOG) (GOOGL) said its Wiz cybersecurity unit used AI models to discover and investigate the vulnerabilities, while its Gemini AI helped assess the flaws, test potential attack vectors, and verify security fixes.

OpenAI said researchers working with its AI models had also helped uncover critical vulnerabilities in PHP. The company said it had spent the past two months working to coordinate fixes and prepare protective measures ahead of public disclosure.

The ChatGPT maker described the flaws as among the most significant security issues in recent memory, highlighting both the potential of advanced AI systems to identify vulnerabilities in widely used software and the risk that similar capabilities could be exploited by cybercriminals.

Cloudflare (NET), which provides cybersecurity and website infrastructure services, said it had deployed protections against the PHP2Shell vulnerabilities through its web application firewall.