CISA warns of active PHP attacks and orders fixes

Federal civilian agencies have three days to patch two critical PHP flaws that can let attackers reach vulnerable systems remotely.

U.S. cybersecurity agency CISA has warned that hackers are actively exploiting two critical vulnerabilities in PHP, the widely used web software behind a large share of internet-facing servers. The agency has ordered civilian federal agencies in the United States to fix affected systems within three days. That makes this more than another routine security advisory.

The warning matters because the bugs can let attackers break into vulnerable systems remotely over the internet, without needing a password. For websites and online services that rely on PHP, the risk is immediate — especially since the software is reported to run on about 70% of web-facing servers.

Federal agencies have three days to patch

CISA’s Monday statement did not name the group behind the attacks or explain exactly how the flaws are being used. Still, the agency’s move shows the threat is no longer theoretical.

The order applies to civilian federal agencies, which now have a narrow window to deploy fixes released by PHP’s maintainers less than a week earlier. The urgency reflects the potential for malicious compromise, service disruption, and data breaches if exposed systems remain unpatched.

The warning also came soon after security researchers said they had found evidence that the vulnerabilities were being exploited in the wild, as IT-PUB News reports.

The PHP flaws allow remote access

The two bugs are known as PHP2Shell. They affect PHP, a decades-old programming language and runtime used to build and run web applications.

The flaws are rated critical because they allow remote access to a vulnerable system over the internet. In practical terms, an attacker may not need stolen credentials or local access to exploit them.

Security researchers said building a working exploit was initially difficult, but still possible. That helps explain why the issue drew attention: the vulnerabilities had been sitting in the software for years, and once a reliable exploitation method was found, the risk changed quickly.

Why the vulnerabilities went unpatched for years

The source says the two vulnerabilities were initially uncovered two years ago. At the time, the nonprofit foundation that maintains PHP said there was no practical way for hackers to exploit them, so the bugs were left unpatched.

That changed earlier this year, when researchers at the security firm Calif found a way to exploit the dormant flaws with the help of an AI model. The case shows how a vulnerability that once seemed low-risk can become dangerous once the attack method becomes easier to develop.

That is one reason the story has drawn attention beyond PHP itself. It points to a broader security problem: bugs that were ignored or deprioritized for years can become urgent once new tools make exploitation more accessible.

AI helped turn a dormant bug into an active threat

The PHP case is being watched as an example of how advances in AI models may affect cybersecurity. The source says such models are increasingly able to find and exploit vulnerabilities, including by chaining multiple flaws together.

That does not mean every old bug suddenly becomes dangerous. But it does mean organizations may need to look more closely at weaknesses once considered impractical to use in real attacks.

For businesses and public agencies, the immediate lesson is simple: patching cannot be postponed just because a flaw appears dormant. Once researchers or attackers find a workable path, the response window can shrink fast.

Widely used open source software faces security strain

PHP is described in the source as one of many aging web technologies that still keep the internet and modern digital services running. Like other open source projects, it has faced years of limited resources and funding.

That matters because security reviews take time and money. If a project cannot afford enough review work, flaws may stay undiscovered longer, or remain a lower priority until a practical exploit appears.

The source does not say the PHP maintainers failed to act once the issue became exploitable. It does, however, show the tension facing widely used but under-resourced software: it can be essential to the internet while still lacking the security support needed to catch problems early.

For organizations running PHP-based systems, CISA’s message is clear. These vulnerabilities are no longer a theoretical concern, and delaying updates may now carry a much higher cost than patching quickly.