CISA Warns Hackers Are Exploiting Critical PHP Security Bugs

The U.S. government has issued an urgent cybersecurity warning after hackers began exploiting two critical vulnerabilities in PHP, a widely used programming language that powers a large portion of the web. The Cybersecurity and Infrastructure Security Agency (CISA) has ordered civilian federal agencies to secure affected systems within three days.

The warning comes less than a week after PHP maintainers released security patches for the vulnerabilities. Both flaws could allow attackers to remotely compromise vulnerable systems over the internet without requiring a password, creating serious risks for websites, applications, and organizations that rely on the technology.

PHP reportedly runs on around 70% of web-facing servers, meaning the potential impact extends across a significant part of the internet. The severity of the vulnerabilities has already prompted some governments and major companies to take their websites offline temporarily while they address the security issues.

PHP Vulnerabilities Raise the Risk of Cyberattacks

Although the two vulnerabilities are classified as critical, security researchers initially found that developing a reliable exploit was technically challenging. However, that difficulty did not make the flaws impossible to exploit.

The confirmation of active attacks has increased pressure on organizations to install the available patches as quickly as possible. Systems that remain vulnerable could face unauthorized access, operational disruption, and potential data breaches.

In a statement issued on Monday, CISA confirmed that the vulnerabilities were being exploited in real-world attacks. The agency did not identify the attackers or provide details about the targets of the reported activity.

Its warning followed reports from security researchers who had also discovered evidence that hackers were taking advantage of the flaws.

The development highlights the difference between a vulnerability that could theoretically be exploited and one that attackers are already using against real systems.

How the PHP2Shell Bugs Went Undetected for Years

The vulnerabilities, referred to as PHP2Shell, remained dormant for years before researchers found a practical way to exploit them.

The flaws were initially discovered two years ago. At the time, the nonprofit foundation responsible for maintaining PHP said there was no practical method for exploiting them, so the vulnerabilities were left without patches.

That assessment changed earlier this year when researchers at security research firm Calif identified a way to exploit both vulnerabilities with assistance from an artificial intelligence model.

The discovery demonstrates how AI tools can help security researchers uncover weaknesses that may have been overlooked or considered difficult to exploit. It also raises concerns about how attackers could use similar capabilities to develop new cyberattacks.

Once a practical exploitation method becomes available, vulnerabilities that have remained unpatched for years can quickly become urgent security threats.

AI Could Turn Old Software Flaws Into New Threats

PHP2Shell is part of a broader cybersecurity challenge involving older software systems and long-standing vulnerabilities.

Many technologies that support the modern internet have been developed and maintained for decades. Although these systems remain essential to websites and online applications, some open-source projects have struggled to secure sufficient funding and resources for comprehensive security reviews.

As a result, vulnerabilities can remain undiscovered or receive limited attention for extended periods.

Advances in AI models are changing that situation. Researchers can increasingly use AI to identify potential weaknesses, develop methods for exploiting them, and connect multiple vulnerabilities to create more effective attack techniques.

These capabilities can benefit defensive security teams, but they may also give malicious actors new ways to target vulnerable systems.

The PHP2Shell discovery illustrates how a flaw that was previously considered difficult to exploit can become a serious risk when new techniques emerge.

Organizations Urged to Patch Vulnerable Systems

CISA’s three-day deadline underscores the urgency of addressing the PHP vulnerabilities, particularly for U.S. civilian federal agencies.

Organizations using affected PHP versions should identify vulnerable systems, apply the available security updates, and review their infrastructure for signs of compromise. Because exploitation has been reported in the wild, installing patches should be treated as an immediate priority rather than a routine maintenance task.

The incident also highlights the importance of continued investment in open-source security. PHP and similar technologies support critical parts of the internet, yet their long-term security depends on maintaining the resources needed to identify, investigate, and fix vulnerabilities.

As AI-assisted security research continues to evolve, organizations may need to reassess older software more frequently. Previously overlooked flaws can become exploitable much faster than expected, making timely patching and proactive security monitoring increasingly important.

For businesses and website operators, the central lesson is clear: even vulnerabilities that have existed for years can become immediate threats when attackers discover a practical way to exploit them.

Also read : inDrive Plans 2027 Robotaxi Tests in Kazakhstan With Pony.ai