Critical flaws in ubiquitous website software draw urgent warning from NSA, FBI

“php2shell” is the collective name for two critical vulnerabilities in PHP, the software running beneath many websites. The article does not provide separate vulnerability names or identification numbers. It says attackers may exploit them without authentication, making systems vulnerable even when individual websites appear carefully secured. That broad exposure prompted urgent warnings from the NSA, FBI, and CISA.

The danger is practical. An attacker could run commands on an affected server, steal data, change website content, or potentially take control. Wiz demonstrated attacks against WordPress, Drupal, and Joomla installations. Researchers also accessed sensitive information in server memory, including passwords and access credentials.

CISA had not observed exploitation when it issued its warning, but said unpatched systems remain at risk. PHP developers released fixes for supported versions Wednesday. Organizations unable to update immediately are being told to take affected systems offline, limiting attackers’ access while fixes are applied.

PHP is a server-side programming language. It works behind a website rather than appearing directly on the page. PHP helps run website functions, process forms, and retrieve information. A visitor sees the finished webpage, while PHP performs much of the work needed to produce or update it.

Popular website-building platforms use PHP as a key component. The article names WordPress, Drupal, and Joomla. A flaw in this shared software can therefore reach many different websites, even when those sites have different owners, designs, and application code. PHP is part of the underlying machinery supporting them.

That role explains the urgency around php2shell. The article estimates PHP powers about 70% of websites whose server-side language can be identified. PHP developers released updates for supported versions, while organizations using Linux distributions or long-term support services were told to check vendors for adapted packages.

Palo Alto Networks’ Unit 42 identified more than 22.6 million internet-exposed instances that might be vulnerable. These are systems reachable through the internet and potentially affected by the PHP flaws. The figure shows why defenders face a large and difficult patching task, especially when organizations cannot easily inventory every exposed system.

PHP is also unusually widespread. Web technology tracker W3Techs estimates that it powers roughly 70% of websites whose underlying server-side programming language can be identified. It supports major platforms including WordPress, Drupal, and Joomla. A vulnerability in PHP can therefore affect many different websites and organizations at the same time.

The article also reports about 900 Shodan results associated with U.S. federal, state, and local government websites showing signs of PHP use. Many displayed older versions, although the records may not reflect current software. CISA had not observed exploitation at publication, but warned that unpatched systems remain risky.

The article says the vulnerabilities allow remote command execution without logging in. In other words, an attacker may send specially crafted activity to an exposed PHP installation and cause the server to perform commands. The article does not describe the exact technical payload or exploitation sequence, but PHP’s developers said all installations handling web requests are at risk.

The possible results are severe. Attackers could steal data, change a website’s contents, or take control of it. Researchers also demonstrated that sensitive information could be read from a server’s working memory. That information included passwords and access credentials. Under certain setups, an attack could happen before the website’s own code executes.

Wiz demonstrated successful attacks against WordPress, Drupal, and Joomla installations. CISA had not seen exploitation when it published its warning, but said unpatched systems pose a risk. Updates, or taking systems offline until they can be fixed, reduce the opportunity for such access.

A website’s application code is only one layer of its technology stack. PHP runs underneath that application and handles web requests before or alongside the site’s own functions. If PHP itself contains a critical flaw, attackers can target that shared foundation instead of exploiting a mistake in the website’s custom code.

The article gives a direct example. Wiz demonstrated successful attacks against WordPress, Drupal, and Joomla installations. PHP’s developers said all installations handling web requests are at risk, and that certain setups allow an attack before the website’s own code executes. This means careful application security cannot block every attack aimed at the underlying runtime.

The issue is especially serious because PHP is widespread. It powers roughly 70% of websites with identifiable server-side languages. Organizations must therefore patch the PHP installations beneath their sites, not simply review their own code. Supported-version updates or vendor packages are the recommended fixes.

The agencies’ instruction is direct: update to the latest PHP version or take systems offline immediately. For organizations that cannot install fixes at once, taking a website offline is the stated alternative. The article does not describe a separate temporary workaround or compensating technical control.

Offline operation reduces risk because an internet-exposed PHP installation is harder for outside attackers to reach when the website is removed from public access. That matters here because the flaws may allow commands to run without login. Cutting off access can provide time to obtain the correct package, test it, and apply the fix, although the article does not detail implementation steps.

The recommendation reflects the scale and uncertainty of the problem. Unit 42 found more than 22.6 million potentially exposed instances, while defenders may not reliably know what needs patching. Governments in Europe had already taken some websites offline to implement fixes.

When someone visits a dynamic website, the web server receives the request and passes needed work to server-side code such as PHP. That code applies the site’s rules, may retrieve or change information in a database, and produces a response for the visitor. The web server then sends that response back. This general flow explains why several components must cooperate.

The article directly covers PHP’s role: it runs websites, processes forms, and retrieves information. It also says PHP sits beneath platforms such as WordPress, Drupal, and Joomla. Databases are not discussed in the article, so their role here comes from established web technology knowledge rather than the source text.

Security flaws can enter through the underlying PHP software, the web server, the website application, database queries, configurations, or the connections between them. In this incident, the key weakness is PHP. An attacker may reach it through web requests, potentially before the site’s own code executes.