US cyber agency orders rapid patch as hackers exploit critical PHP flaws

Hackers are actively exploiting two critical PHP vulnerabilities, leading CISA to order all civilian federal agencies to patch their systems within three days. The vulnerabilities, called PHP2Shell, let attackers break into a server over the internet without needing a password. The U.S. cyber agency confirmed the in‑the‑wild exploitation in a Monday statement, though it did not name the threat actors. The warning follows a patch released by the PHP development team less than a week earlier. The bugs were first discovered two years ago but were deemed impractical to exploit until the AI‑assisted method emerged. PHP runs on roughly 70 % of web‑facing servers, so the flaws put many major sites at risk. Some governments and large companies have already taken their sites offline to apply the fixes. Security researchers noted that creating a working exploit was hard at first, but earlier this year a team at the security firm Calif used an AI model to turn the dormant bugs into a usable attack. The incident highlights how AI can accelerate the discovery and use of old, unpatched flaws. Open‑source projects like PHP often lack funding for thorough security reviews, leaving such weaknesses hidden for years. CISA’s urgent directive aims to stop further malicious compromises, data breaches, and service disruptions. Agencies must comply by the three‑day deadline or face heightened risk.

Context

PHP is the scripting language behind many websites and web apps. When a widely used platform has a serious flaw, attackers can target countless sites with the same tool.