CISA Flags PHP Bugs as Actively Exploited

Two PHP bugs have moved onto the U.S. government’s list of flaws known to be exploited. The formal warning turns a serious risk into an urgent repair job. The vulnerabilities, called PHP2Shell, can let attackers break into web servers and run code without a password. CISA has also told civilian federal agencies to fix their systems within three days. ^11,1

That three-day order follows emergency fixes released by the PHP project on October 21. The bugs affect PHP itself, the software that helps websites run, rather than one particular site or app. PHP is used on about 70% of web-facing servers, and the flaws can affect systems that handle web requests. The fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. ^4,9

Those web-facing servers include government services, businesses and sites run through outside providers. CISA says organizations should find every system running PHP, install a fix, and give internet-facing systems priority. If a system cannot be fixed, the agency says it should be taken offline. Researchers first found the bugs two years ago, but PHP’s maintainers then believed there was no practical way to exploit them. Researchers at Calif later used an AI model to find a working method, and security firms have reported attackers probing vulnerable systems. ^4,9,11

That discovery points to a wider problem: old, widely used software can be hard to secure when its open-source maintainers have limited resources. AI tools may also help attackers turn overlooked flaws into working break-ins. CISA has not named the attackers behind the PHP2Shell exploitation. The next step is clear: organizations need to check their PHP systems and install a fixed release, or take vulnerable services offline until they can. ^1,6,17