The US National Security Agency has issued a critical warning to operators of PHP-based websites about a vulnerability called PHP2Shell that, the agency notes, could allow attackers to take control of affected web servers without prior access or authentication.
The source provides this warning and the stated risk but contains no further technical details or remediation steps.
PHP2Shell: what it means for PHP-based websites
According to the NSA notice, PHP2Shell can enable attackers to gain control of vulnerable servers without needing prior access or authentication. The alert specifically concerns operators of PHP-based sites that run software affected by this vulnerability.
What you should do
The source does not list specific mitigation measures. Site administrators should consult official NSA communications, vendor advisories and their own security teams for confirmed guidance and updates.
