CISA Confirms Active Exploitation of Critical PHP2Shell Bugs, Gives Agencies 3 Days to Patch

8.0 · 4d ago · US · TECH

The Facts

  • CISA confirmed that hackers are actively exploiting two critical vulnerabilities in PHP, known as PHP2Shell. TechCrunch only
  • CISA ordered civilian federal agencies to fix their systems within three days. TechCrunch only
  • CISA made the announcement in a Monday statement and did not say who is exploiting the bugs. TechCrunch only
  • The PHP maintainers released patches for the two bugs less than a week before CISA's warning. TechCrunch only
  • The bugs allow remote system compromise over the internet without passwords. TechCrunch only
Dive deeper · 5 more factsShow less
  • PHP is reportedly used by about 70% of web-facing servers. TechCrunch only
  • Some governments and large companies took their sites offline to fix the bugs. TechCrunch only
  • The bugs were first uncovered two years ago, but the nonprofit foundation that maintains PHP said there was no practical way to exploit them, so they stayed unpatched. TechCrunch only
  • Researchers at security firm Calif found a way to exploit the two dormant bugs earlier this year with the help of an AI model. TechCrunch only
  • Security researchers said they found evidence of exploitation shortly before CISA's statement. TechCrunch only

Context

The US Cybersecurity and Infrastructure Security Agency has confirmed active exploitation of two critical vulnerabilities in PHP, collectively called PHP2Shell. It ordered civilian federal agencies to patch within three days.

The flaws let attackers remotely break into vulnerable systems without credentials. They went unexploited for years until Calif researchers developed an exploit with AI assistance. PHP's maintainers released patches less than a week before the CISA warning.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 0.

8 Policy Expert CISA issued a concrete binding directive ordering federal agencies to patch within three days, and the critical PHP flaws affect about 70% of web-facing servers with some governments and companies taking sites offline, making this significant, widespread news with real operational impact.
8 Global Affairs Analyst Confirmed active exploitation of critical unauthenticated remote code execution bugs in software used by about 70% of web servers, with government sites taken offline and an emergency federal patch directive, affects many people and systems immediately.
8 Critical Reader A confirmed active exploitation of unauthenticated remote-compromise bugs in PHP, which runs on about 70% of web-facing servers, prompted a binding federal patch order and real site takedowns, so the concrete impact is broad.
8 News Editor A confirmed active exploitation of critical, unauthenticated remote-compromise flaws in software used by about 70% of web servers, with a binding federal patch deadline and sites already going offline, is a significant, widespread, timely event affecting many people.
8 Business Analyst A CISA emergency directive confirming active exploitation of unauthenticated remote-compromise bugs in PHP, which runs on about 70% of web servers, with governments and major companies taking sites offline, is a concrete, widely impactful cybersecurity event.
8 Science & Tech Analyst A confirmed active exploitation of critical, unauthenticated remote code execution bugs in PHP, used by about 70% of web servers, with a CISA 3-day federal patch mandate and governments and large companies taking sites offline, is a significant concrete security event affecting many people.
8 Informed Citizen Actively exploited unauthenticated remote-compromise bugs in PHP, used by about 70% of web servers, with some governments and large companies taking sites offline, is a significant concrete event affecting many people and organizations.

Source

← All stories