National Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language

Calif researchers first found this flaw using OpenAI’s GPT-5.6 Sol

In Europe, Asia and on other continents, authorities have taken a number of government websites offline for the time being to protect them from newly identified security vulnerabilities in a programming language that powers the vast majority of websites online.

The NSA told organizations to patch 2 critical PHP flaws, dubbed PHP2Shell, or pull unpatched servers offline.

Both bugs live in PHP’s core, so every installation serving web requests is at risk, whatever site runs on top.

When a request exhausts memory or hits a fatal error, PHP can leave half-built or freed memory that cleanup code or later requests trust.

On Apache’s mod_php, a demonstrated exploit triggers the corruption before any application code runs, so logins and app-level checks cannot block it.

Cloudflare saw attacks before PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21.

VirusTotal counts about 5.1M IP addresses running PHP, and about 758K that show a version run end-of-life branches with no patched release.
That long tail will set how long PHP2Shell stays exploitable, since each owner must upgrade, find a backport or take the server offline.