Hackers Launch Millions of Attacks as Critical PHP Flaws Threaten Websites Worldwide: What You Need to Know

The NSA issued a rare public advisory on the PHP2Shell vulnerabilities, warning that cyber actors are likely to exploit them (Credit: Screenshot from NSA Website)

Web administrators spent this week scrambling to patch two critical flaws in PHP, the software behind a large share of the world's websites, after security firms began logging live attacks and the US National Security Agency told organisations to update immediately.

The two bugs, tracked together as PHP2Shell, let an attacker seize control of a web server with no password, no login, and no prior foothold. Both carry a severity rating of 9.2 out of 10 on the CVSS v4.0 scale, near the top of the critical band. The PHP security team shipped emergency fixes on Wednesday, 21 October, a day earlier than planned.