What happened in this Tech story?

CISA confirmed that hackers are actively exploiting two critical PHP web vulnerabilities and gave civilian federal agencies three days to patch them, ending a two-year stretch in which the flaws were considered impractical to exploit.

What is a key fact in this story? (1)

**CISA** confirmed that hackers are now actively exploiting a pair of critical PHP vulnerabilities, ordered civilian federal agencies to fix their systems within three days, and did not say in its Monday statement who is behind the attacks.

What is a key fact in this story? (2)

**PHP2Shell**, the name given to the two flaws, was uncovered two years ago but left unpatched because the nonprofit foundation that maintains the language said there was no practical way to exploit it; patches finally shipped less than a week before CISA's warning, and both bugs let attackers break into vulnerable systems remotely over the internet without passwords.

CISA Orders Federal Patch for Exploited PHP Flaws — SkimNews

By TechCrunch · Summarized & edited by Kapil Samant · 2026-10-27

Get the Tech newsletter

Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.

CISA confirmed that hackers are now actively exploiting a pair of critical PHP vulnerabilities, ordered civilian federal agencies to fix their systems within three days, and did not say in its Monday statement who is behind the attacks.
PHP2Shell, the name given to the two flaws, was uncovered two years ago but left unpatched because the nonprofit foundation that maintains the language said there was no practical way to exploit it; patches finally shipped less than a week before CISA's warning, and both bugs let attackers break into vulnerable systems remotely over the internet without passwords.
PHP is reportedly used by some 70% of web-facing servers, and the severity of the bugs prompted some governments and big companies to take their sites offline to apply the fixes.
Calif researchers found a way to exploit the two dormant PHP vulnerabilities with the assistance of an AI model, a path security researchers said was initially challenging but not impossible.
AI models now find and exploit vulnerabilities that have gone undiscovered or deprioritized for years, including by chaining multiple flaws together, and the two PHP bugs are among countless examples now posing risk.
PHP, one of many aging web technologies that keep modern services running, has been under-resourced and under-funded for years, making it difficult for the project to pay for security reviews that might have uncovered these flaws sooner.

Why it matters: With a three-day federal patching deadline and PHP on roughly 70% of web-facing servers, the response window is now shorter than the two years the bugs sat unpatched. The AI-assisted exploit path Calif demonstrated turns an open source backlog into an active breach risk for federal agencies, major sites and their users' data.