U.S. Government Warns of Active Exploitation of Critical PHP Vulnerabilities

CISA Orders Federal Agencies to Patch Within Three Days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers are currently leveraging two severe flaws in PHP, a core web technology. In a Monday alert, CISA directed all civilian federal agencies to remediate the issues within 72 hours.

Recent Patches Follow Long‑Standing Bugs

Patches for the two bugs were released less than a week ago by the PHP project, which maintains a language that powers roughly 70% of internet servers. The vulnerabilities, dubbed PHP2Shell, allow remote code execution without authentication, prompting several governments and large corporations to temporarily shut down affected services.

Exploitation Once Considered Unlikely Now Confirmed

Although the flaws were classified as critical, security experts initially thought crafting a working exploit would be difficult. Recent real‑world attacks have proven that exploitation is feasible, raising the urgency for organizations to apply the updates and avoid data loss, service disruption, and unauthorized access.

Evidence of In‑the‑Wild Attacks Emerged Earlier

CISA did not name the attackers, but its warning followed reports from researchers who detected active abuse of the PHP bugs. The vulnerabilities had lingered for two years after their discovery, with the PHP Foundation concluding that no practical exploit existed.

AI‑Assisted Discovery Revives Old Flaws

Earlier this year, researchers at security firm Calif used an artificial‑intelligence model to demonstrate how the previously dormant vulnerabilities could be chained and exploited. This breakthrough highlighted a broader trend: advances in AI are now enabling the detection and weaponization of long‑neglected bugs.

Broader Implications for Aging Open‑Source Software

PHP illustrates the challenges faced by many legacy web technologies that remain essential but suffer from chronic underfunding. Without resources for thorough security audits, projects like PHP struggle to identify and fix flaws before they become exploitable.