CISA: Hackers Now Exploiting Two Critical PHP Flaws, Agencies Given Three Days to Patch

The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Monday that attackers are actively exploiting two critical PHP vulnerabilities. Civilian federal agencies have been given three days to secure their systems.

The two flaws, known collectively as PHP2Shell, allow an intruder to take remote control of an exposed system over the internet without needing a password. Fixes were released by the developers of the decades-old programming language less than a week before the warning was issued.

PHP powers an estimated 70% of internet-facing servers, leaving many major websites and applications exposed to the bugs. Given the severity of the flaws, some governments and large companies took their sites offline while applying the patches.

CISA did not identify who is behind the attacks. Its statement came after security researchers reported finding evidence that the flaws were being exploited in real-world attacks. Those researchers had earlier noted that building a working exploit was difficult at first, though not impossible.

The two weaknesses were first identified two years ago. At the time, the nonprofit foundation that maintains PHP judged that hackers had no practical way to exploit them, so no fix was issued. That changed earlier this year, when the security research firm Calif found a method to exploit both flaws with the help of an AI model.

The case adds to a growing list of old or overlooked vulnerabilities that have turned into active threats as AI systems become better at finding and combining flaws to exploit them. Like other ageing open-source technologies, PHP has suffered from years of underfunding, limiting its ability to pay for the kind of security audits that might have caught the problems sooner.