NSA Says Patch PHP or Go Offline as AI-Found PHP2Shell Flaws Reach ~70% of the Web

NSA Says Patch PHP or Go Offline as AI-Found PHP2Shell Flaws Reach ~70% of the Web

How much of the web PHP2Shell touches PHP2Shell reaches most of the web because it lives in PHP itself, not in any one app. Sansec reports the vulnerable code dates to PHP 5.4 in 2012 and default configurations are exposed, so the risk is the language's entire footprint. Measure Figure Source Websites with a known server language that run PHP 70–80% Kinsta, via CyberScoop Same measure, August 2026 70.2% (65.9% among the top 1 million sit…

PHP2Shell: AI exposes critical vulnerabilities of 70% of the web

Security fixes are available for two critical PHP flaws, but businesses may have vulnerable copies inside older software and equipment that need separate updates

Sites Go Dark As Admins Rush To Patch PHP Flaw

Governments, other organisations take websites offline after researchers publish fix for critical PHP flaw affecting 70 percent of internet Read more →

NSA Issues Advisory on Critical Patches for PHP Vulnerabilities

The PHP hypertext preprocessor on most major operating systems is vulnerable to exploitation and hacking. The National Security Agency (NSA) and Central Security Service issued an advisory on…

NSA, CISA Urge Immediate Patching of PHP2Shell Flaws

NSA and CISA urge organizations to patch two critical PHP flaws that could let attackers take over web servers without logging in. The post NSA, CISA Urge Immediate Patching of Critical ‘PHP2Shell’ Vulnerabilities first appeared on Executive Gov.