Two vulnerabilities dubbed PHP2Shell could let attackers remotely run malicious code on affected PHP servers and access files, databases and sensitive data. The NSA urged organizations to install updates or take vulnerable systems offline, while Google, OpenAI and Amazon joined response efforts.