The National Security Agency issued an urgent advisory on Wednesday warning organizations to patch critical vulnerabilities in the PHP programming language or take affected systems offline to prevent exploitation. The flaws, collectively known as PHP2Shell, affect a language that powers roughly 70 percent of identifiable websites worldwide.

PHP developers released emergency patches on October 21 following discovery of the issues by security researchers using Super Intelligence tools. The NSA stated that the vulnerabilities often provide a direct path to a server's file system or database and recommended immediate inventory of systems reliant on vulnerable PHP versions. Where updates could not be applied promptly, the agency advised taking systems offline until mitigation was complete.

Several governments acted on similar warnings from their cybersecurity agencies. Finland temporarily shut down public web services, while the Netherlands took its cyber security agency website offline. Other European nations including Belgium, Germany, and the Czech Republic reported site disruptions for patching. Japan's Prime Minister also urged website operators to check for PHP usage and apply fixes or suspend services.

The vulnerabilities allow attackers to execute code on servers without authentication, potentially enabling data theft or service disruption. Researchers at firms including Wiz described the issues as among the most severe identified with Super Intelligence assistance. The FBI and Cybersecurity and Infrastructure Security Agency joined the NSA in urging swift action.

Many organizations applied patches quickly, though experts noted that outdated systems may remain exposed. The NSA emphasized prioritizing identification of malicious actors seeking to exploit the flaws and called for enhanced logging and replacement of end-of-life PHP services.

The incident highlights the widespread reliance on open-source components in critical internet infrastructure and the speed required for coordinated responses to emerging threats.