The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says two critical vulnerabilities in PHP are being actively exploited. The agency has directed civilian federal departments to secure affected systems within three days.
PHP maintainers recently released fixes for the flaws, known as PHP2Shell. The vulnerabilities could let an attacker access exposed systems remotely without a password. PHP is used by a large share of web-facing servers, making timely updates important for organizations that rely on the software.
From overlooked flaws to urgent fixes
Security researchers had previously considered exploitation difficult, but new research demonstrated a practical approach, reportedly with help from an AI model. CISA's warning adds urgency for administrators to apply available patches and review whether their systems are affected.
The case also highlights the importance of sustained security work on widely used open-source infrastructure. As tools for finding software weaknesses evolve, regular maintenance and timely patching will be increasingly important to keeping the web resilient.
