CISA confirms active exploitation of critical PHP flaws, gives US agencies three days to patch

The United States' cybersecurity agency, CISA, confirmed on Monday (the 26th) that hackers are already actively exploiting two critical vulnerabilities in PHP. The agency gave civilian federal government agencies a three-day deadline to fix their systems, according to a TechCrunch report.

The alert comes less than a week after PHP's maintainers released patches for the two flaws, which allow an attacker to take remote control of a vulnerable server over the internet without needing a password. The severity of the issue had already led governments and large companies to take sites offline to apply the fix even before active exploitation was confirmed.

CISA did not detail, in its Monday statement, who is behind the attacks. The warning came shortly after independent security researchers reported evidence that the flaws were already being used in real-world attacks.

PHP2Shell: from a forgotten discovery to a real exploit

The two flaws were named PHP2Shell. According to TechCrunch, they were discovered two years ago, but the nonprofit foundation that maintains PHP determined at the time that there was no practical way to exploit them, and the bugs went unpatched.

That changed this year. Researchers at security firm Calif found a way to exploit the two dormant vulnerabilities with the help of an AI model. The PHP2Shell case is not an isolated one: the report notes that this kind of flaw, discovered but set aside for seeming harmless, is increasingly common among the targets of AI models capable of chaining multiple vulnerabilities together until they assemble a working exploit.

In short: what separated a theoretical flaw from a practical exploit stopped being the manual work of a human researcher and became the processing time of an AI model. This narrows the safety margin that projects like PHP had when deciding not to fix bugs considered low practical risk.

Why this matters so much when 70% of the web runs PHP

PHP powers, according to the report, around 70% of internet-facing servers. In Brazil, that share shows up in WordPress (which alone already accounts for a large part of the country's web), in frameworks like Laravel and Symfony, in legacy systems at banks, retailers and the public sector, and in a large portion of admin panels that run behind CDNs without anyone monitoring them closely.

CISA issues patch orders (known as Binding Operational Directives) only for civilian agencies of the US government, but the practical effect extends beyond US borders: once a critical flaw in such widely used software moves from theoretical to exploited, the clock starts running for everyone else on the same stack too. That applies both to those who run their own infrastructure and to those who outsource hosting without knowing which PHP version is running underneath.

TechCrunch's report also places the case within a more structural problem: PHP is one of many aging technologies that underpin the modern internet but have received insufficient funding and resources for years, which makes it harder for open-source projects like this one to afford the security reviews that could have caught these flaws sooner.

Technical checklist: what to do now

Anyone maintaining any PHP application in production, whether their own or a third party's, has a few immediate checks to run:

1. Confirm the PHP version in use (php -v on the server or container) and compare it against PHP's official security changelog to check whether the latest patch is already applied.
2. Check, in the case of managed hosting (cPanel, shared hosts, PaaS), whether the provider has already applied the update or whether the patch depends on manual action from the customer.
3. Review dependencies via composer outdated, since frameworks like Laravel and Symfony usually lock the minimum supported PHP version in composer.json.
4. Check recent access logs for unusual patterns on admin or upload endpoints, common in exploits aiming for remote code execution.
5. Prioritize the patch above any other sprint task if the environment is exposed to the public internet, since CISA classified the situation as confirmed exploitation, not just theoretical risk.

For those managing multiple environments, it's worth treating this patch with the same urgency as a zero-day flaw in production: this isn't the moment to wait for the next scheduled maintenance window.

What remains unclear

CISA did not disclose the CVE identifiers for the two flaws or detail the exact technical vectors of PHP2Shell in its public statement, and TechCrunch had not obtained that information by the time its story was published. There is also no public confirmation of which groups are behind the active exploitation, nor of how many systems have already been compromised outside the universe of US federal agencies monitored by CISA.

The episode reinforces a pattern that is likely to repeat: vulnerabilities shelved for years because they seemed impractical to exploit are being reopened by AI models capable of assembling exploits that a human researcher would take months to build by hand. For anyone running software in production, this changes the risk calculus for any "known but unpatched" bug in the stack.