CISA: Hackers Exploiting Critical PHP Flaws — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- CISA confirmed active exploitation of two critical PHP vulnerabilities and ordered civilian federal agencies to patch their systems within the next three days.
- PHP maintainers rolled out patches less than a week earlier for flaws that allow remote system compromise over the internet without passwords; the software is reportedly used by some 70% of web-facing servers, and some governments and large companies took their sites offline to fix them.
- PHP2Shell was the name given to the two bugs, which were uncovered two years earlier but left unpatched after the nonprofit foundation maintaining PHP said there was no practical way for hackers to exploit them.
- Calif researchers found earlier this year that an AI model could assist with exploiting the two dormant PHP vulnerabilities; security researchers said developing a working exploit was initially challenging but not impossible.
- CISA did not identify who was exploiting the PHP flaws in its Monday statement, even as security researchers said they had found evidence that the bugs were being exploited.
- PHP is a decades-old open-source project whose years of under-resourcing and under-funding made it difficult to pay for security reviews that might have uncovered flaws sooner.
Why it matters: With PHP reportedly used on some 70% of web-facing servers, CISA’s three-day deadline leaves federal agencies little time to address actively exploited flaws. The practical, AI-assisted exploit shows why the earlier judgment that the flaws were impractical to abuse no longer holds, making patching a direct defense against compromise, disruption and data breaches.
Ask SkimNews
