CISA confirms hackers are exploiting two critical PHP bugs

The US cybersecurity agency CISA has ordered civilian federal agencies to fix two critical PHP flaws within three days. Exploitation of the bugs, known as PHP2Shell, is now confirmed.

CISA said on 26 October that hackers are actively exploiting two critical vulnerabilities in PHP, and gave US civilian federal agencies three days to patch their systems.

The bugs, known as PHP2Shell, let attackers break into a vulnerable system over the internet without a password. They were first found two years ago, but the foundation behind PHP said there was no practical way to exploit them and left them unpatched. Researchers at security firm Calif later found a way to exploit them with the help of an AI model, and patches followed on 21 October. According to The Register, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CISA did not say who is behind the attacks.

PHP is reportedly used by about 70% of web-facing servers, and some governments and large companies took sites offline to fix the flaws. The case shows how quickly a flaw judged hard to exploit can turn into an active threat once a working method exists.

This is a short summary by Zaxvix based on the source above. We write our summaries with the help of AI and check them before publishing. For the full story, read the original. Spotted an error? Email hello@zaxvix.com and we will review the article and correct or remove it if needed.