US Cybersecurity Agency Warns of Active Exploitation of Critical PHP Vulnerabilities

Image: TechCrunch · Source

The US CISA alerts that hackers are now exploiting critical, remotely accessible PHP bugs affecting 70% of web servers, urging immediate patching to prevent breaches.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning that hackers are actively exploiting two critical security vulnerabilities in PHP, a widely used web programming language embedded in approximately 70% of internet-facing servers. These flaws allow attackers to remotely compromise vulnerable systems without needing passwords. Following patches released by the PHP development team less than a week ago, CISA mandated that civilian federal agencies fix these vulnerabilities within three days to mitigate the threat.

The vulnerabilities, collectively dubbed PHP2Shell, had been identified over two years ago but remained unpatched due to initial assessments that exploitation was impractical. However, recent advances—especially by AI-assisted research—have enabled attackers to chain these flaws and develop working exploits, shifting these dormant bugs into active threats. This escalation has forced organizations and governments worldwide to urgently review and secure their PHP-dependent infrastructure, with some opting to temporarily take sites offline to apply fixes.

Security researchers initially considered exploiting these bugs challenging but have now verified in-the-wild attacks, increasing pressure on organizations to patch quickly to prevent potential data breaches, service disruptions, and malicious system compromises. CISA has not disclosed details about the actors exploiting these vulnerabilities.

The emergence of these exploits underscores broader concerns regarding aging open-source technologies like PHP which, despite their critical role in running major parts of the internet, have suffered from underfunding and insufficient security auditing for years. The situation highlights the growing impact of artificial intelligence in accelerating vulnerability discovery and exploitation, propelling once-neglected flaws into immediate cybersecurity risks.

This development serves as a stark reminder of the ongoing challenges in maintaining and securing foundational web infrastructure and the urgent need for increased investment in ongoing security review and patching of open-source projects essential to global internet operations.