GoKawiilCISA confirms active exploitation of critical PHP flaws, gives agencies 3 days to patch
CISA has confirmed that hackers are actively exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, and ordered U.S. civilian federal agencies to patch affected systems within three days. The flaws let attackers remotely compromise systems without credentials, and PHP powers roughly 70% of web-facing servers worldwide.
GoKawiil's interpretation of the reporting above, not reported fact.
The confirmed exploitation raises the urgency for organizations beyond federal agencies to patch quickly, since the bugs could enable widespread breaches and disruption given PHP's dominance online. The bugs sat unpatched for two years because they were deemed impractical to exploit until researchers reportedly used AI assistance to develop a working exploit, which suggests AI tools may be accelerating discovery of previously dismissed vulnerabilities.
- CISA mandates federal civilian agencies patch two critical PHP bugs within three days.
- The flaws, called PHP2Shell, allow remote system compromise without passwords.
- Researchers reportedly used AI assistance to turn a long-dormant vulnerability into a working exploit.
Source: techcrunch.com — Zack Whittaker, 2026-10-27
Published there as: “US government says hackers are now exploiting critical PHP web bugs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.