Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond

21 October 2026, Baden-Württemberg, Stuttgart: When someone visits the website of the Baden-Württemberg Ministry of the Interior, a warning appears in the browser about a possible security problem. A serious security weakness is putting websites around the world at risk. Blogs, online stores and news websites could be attacked. The weakness in PHP could allow attackers to take control of entire servers. Photo: Bernd Weißbrod/dpa (Photo by Bernd Weißbrod/picture alliance via Getty Images)

Technology companies are rushing to fix serious security weaknesses recently found in software that powers much of the internet.

The software, called PHP, is a programming language that is freely available for anyone to use and is widely used to run websites and web applications. The discovery of these weaknesses led governments around the world to issue urgent warnings. Major technology companies, including Google, OpenAI and Amazon, have helped find the weaknesses, look for possible attacks and protect systems that may be affected.

The two weaknesses, together known as "PHP2Shell," could let hackers run harmful code on affected servers from a distance. This could put private and sensitive information at risk, cybersecurity researchers said. Not every website that uses PHP is necessarily at risk, but because the software is so widely used, experts are worried that attacks could affect many systems.

On Wednesday, the U.S. National Security Agency urged organizations that use PHP to get ready to install security updates that fix the weaknesses. The agency warned that attackers could use the flaws to gain direct access to server files and databases. It recommended taking affected systems offline until the problems are fully fixed if updates cannot be installed right away.

The Federal Bureau of Investigation also warned that attackers could use the weaknesses to run code on affected systems from a distance. This could put sensitive information and computer networks at risk.

Cybersecurity agencies in Singapore, the United Kingdom, Australia, Canada and the European Union have issued similar warnings. These alerts show that authorities are concerned about the possible effects on businesses, government agencies and other organizations that depend on systems built with PHP.

Amazon said its threat intelligence team had found attempts to exploit the weaknesses before they were made public. The team used MadPot, Amazon's system for spotting suspicious activity across computer systems and services connected to the internet. Amazon said these findings suggest that attackers were already trying to take advantage of the weaknesses. However, the company said it was still unclear how the attackers learned about the flaws before they were publicly announced.

Google and OpenAI also pointed to the growing role of artificial intelligence (AI) in finding and fixing cybersecurity threats. Google said its cybersecurity company Wiz used AI models to help find and investigate the weaknesses. Google's Gemini AI also helped experts study the flaws, test possible attacks and check that security fixes worked.

OpenAI said researchers using its AI models had also helped discover serious weaknesses in PHP. The company said it had spent the previous two months leading a group of software maintainers, cybersecurity researchers and security companies. They worked together to coordinate fixes and prepare ways to protect systems before the weaknesses were publicly announced.

The company behind ChatGPT described the weaknesses as some of the most serious security problems seen in recent memory. The case shows how advanced AI systems can help researchers find weaknesses in widely used software. It also highlights the risk that cybercriminals could use similar AI abilities to carry out attacks.

Cloudflare, a company that provides website infrastructure and cybersecurity services, said it had put protections in place against the PHP2Shell weaknesses through its web application firewall. This system is designed to help block harmful requests aimed at affected systems. The protections provide an extra layer of defense while organizations work to install software updates.

The PHP development team has released security fixes. Authorities are urging website operators to check whether they are using affected versions of PHP and install the updates as soon as possible. The incident shows how weaknesses in widely used software can put organizations across many industries and countries at risk. It also highlights the growing role of AI in helping security researchers find and fix these problems.