CISA Orders Rapid Patching as PHP2Shell Exploits Emerge

CISA confirms exploitation of two critical PHP flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities, known as PHP2Shell, to its warning of actively exploited flaws. Civilian federal agencies have been ordered to remediate affected systems within three days.

The vulnerabilities were patched by the maintainers of the PHP programming language less than a week before CISA’s warning. They can allow an attacker to compromise a vulnerable system remotely over the internet without needing a password.

CISA did not identify the party behind the activity in its Monday statement. Its action followed reports from security researchers that they had found evidence of exploitation in the wild, turning a serious theoretical exposure into an urgent operational issue.

Why the PHP2Shell warning has broad reach

PHP is reportedly used by about 70% of web-facing servers. That installed base means vulnerable deployments may sit behind major websites and applications, and the critical rating reflects the potentially severe effect of a successful compromise.

Some governments and large companies took websites offline while applying fixes. Researchers had said that creating a functional exploit was initially difficult, though not impossible. Confirmed exploitation increases pressure on organizations to patch before attackers can use the flaws for compromise, disruption or data breaches.

AI-assisted research changed the risk picture

The two weaknesses had been undiscovered for years. They were initially identified two years ago, but the nonprofit PHP Foundation said there was no practical means to exploit them, so they remained unpatched.

Earlier this year, researchers at security firm Calif found a way to exploit the dormant vulnerabilities with assistance from an AI model. The case illustrates how flaws that were once deprioritized can become actionable when researchers can chain weaknesses or explore attack paths more effectively.

PHP is among long-lived web technologies that remain essential to modern internet services. The source notes that aging, under-resourced open-source projects can struggle to fund security reviews that might identify such weaknesses sooner.

Business implication

Organizations operating internet-facing PHP systems should establish where PHP is deployed, apply the available security updates promptly and review exposed systems for indications of malicious compromise.