Washington — CISA Orders Federal Agencies to Patch PHP Bugs

The Cybersecurity and Infrastructure Security Agency confirmed Monday that hackers are actively exploiting two critical vulnerabilities in the PHP programming language and ordered civilian federal agencies to patch their systems within three days, according to TechCrunch.

The directive follows patches the maintainers of PHP released less than a week earlier for the flaws, which let attackers break into a vulnerable system remotely over the internet without a password, TechCrunch reported. PHP is used on an estimated 70% of web-facing servers, according to the outlet, meaning the bugs touch a large share of the sites and applications that run on the internet.

What are the PHP vulnerabilities CISA is warning about?

The flaws are known as PHP2Shell, TechCrunch reported. CISA's Monday statement did not identify who is exploiting the bugs, but the agency's warning came shortly after security researchers said they had found evidence of in-the-wild exploitation, according to the outlet. Because the vulnerabilities are rated critical, successful exploitation can let an attacker take over a system without needing stolen credentials.

Why did hackers wait two years to exploit them?

The two bugs were first identified two years ago, but the nonprofit foundation that maintains PHP determined at the time that there was no practical way to exploit them and left them unpatched, TechCrunch reported. That changed earlier this year when researchers at security firm Calif found a method to exploit the dormant flaws with help from an AI model, according to the outlet. Security researchers cited by TechCrunch said building a working exploit was initially difficult but not impossible.

How widespread is the risk to websites and companies?

The severity of the bugs led some governments and large companies to take their sites offline to apply fixes, TechCrunch reported. The outlet noted that PHP is one of several aging web technologies that keep much of the internet running but that have been under-resourced for security review, which can leave flaws undiscovered for years before they are exploited.

The two bugs in PHP are among countless vulnerabilities that have not yet been discovered or have been deprioritized for years but now pose a risk due to advances in AI models' ability to find and exploit vulnerabilities, TechCrunch reported.

What happens if agencies miss the deadline?

CISA's directive applies to federal civilian agencies, which must patch within three days of the Monday order, according to TechCrunch. The outlet's report does not specify penalties for missing the window, but confirmed exploitation raises the stakes for any organization — government or private — running unpatched PHP installations.

What to watch

• Whether CISA or other researchers publicly attribute the exploitation to a specific hacking group.
• Additional reports of government or corporate sites going offline to apply the PHP patches.
• Signs that attackers are chaining the PHP2Shell flaws with other vulnerabilities, a pattern researchers say AI tools are making easier.

Glossary

• CISA: The U.S. Cybersecurity and Infrastructure Security Agency, which issues security directives to federal civilian agencies.
• PHP: A decades-old web programming language used to build a large share of websites and server-side applications.
• PHP2Shell: The name given to the pair of critical PHP vulnerabilities now under active exploitation, per TechCrunch.
• Critical vulnerability: A software flaw rated severe enough that exploitation can lead to full remote system compromise.