The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that threat actors are currently exploiting two critical flaws in the widely deployed PHP web programming language. In a new directive, CISA ordered all civilian federal agencies to remediate the vulnerabilities on their systems within three days. The warning follows the release, less than a week ago, of patches from the PHP development team for the two bugs that allow remote code execution without authentication.
PHP powers an estimated 70 percent of internet‑facing servers, meaning that major websites and applications could be exposed. The seriousness of the flaws prompted several governments and large corporations to temporarily shut down affected sites while they applied fixes. Although the vulnerabilities were rated critical, early analysis suggested that creating a functional exploit would be difficult, but not impossible. Evidence of real‑world exploitation now adds urgency for organizations to patch before attackers can cause data breaches, service disruptions, or other damage.
CISA’s statement, released on Monday, did not identify the groups behind the attacks, but it arrived shortly after security researchers reported signs of active exploitation. The flaws, dubbed PHP2Shell, have existed in the software for years without detection. They were first discovered two years ago, but the nonprofit foundation that maintains PHP concluded that they could not be weaponized, leaving them unpatched. Earlier this year, researchers at the security firm Calif succeeded in building an exploit with the help of an artificial‑intelligence model.
The two PHP bugs join a long list of vulnerabilities that have either not yet been found or have been deprioritized for years. Advances in AI capabilities are now enabling attackers to discover and chain together such flaws more effectively. PHP, like many legacy web technologies, has suffered from chronic under‑funding, making it hard for open‑source projects to afford comprehensive security reviews that might have uncovered these issues sooner.
CISA’s rapid response underscores the growing risk posed by aging internet infrastructure and the need for timely patching across both public and private sectors.
Zack Whittaker, security editor at TechCrunch, reported the story. He also writes the weekly newsletter “This Week in Security” and can be reached via encrypted Signal message at zackwhittaker.1337 or by email at the address provided in the original article.