CISA Orders U.S. Federal Civilian Agencies to Patch Actively Exploited Critical PHP Vulnerabilities Within 72 Hours

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has formally verified that malicious hacking groups are carrying out active, in-the-wild exploitation of two high-severity security flaws in the globally ubiquitous PHP web programming platform, and issued a mandatory directive for all U.S. government civilian agencies to remediate all their exposed at-risk systems within the next three days.

This emergency patching alert was released less than one week after the non-profit PHP Foundation, steward of the 30-year-old open source web programming language, rolled out official security patches for the two critical bugs. The pair of flaws, dubbed collectively as PHP2Shell, enable unauthenticated remote attackers to fully compromise any vulnerable internet-connected server directly over public networks, with no stolen credentials or complex social engineering required.

Industry statistics indicate that approximately 70% of all public, web-facing servers run PHP, leaving a massive attack surface spanning major commercial websites, enterprise applications, government digital services and widely used content management systems exposed to potential compromise. The extreme risk level of the vulnerabilities was severe enough that multiple national government bodies and large multinational corporations already took portions of their public web properties offline preemptively to apply patches and avoid being hacked.

While the two bugs were officially categorized as critical severity (the highest possible rating for software vulnerabilities, indicating massive potential for harm), security researchers noted that developing a fully functional, reliable exploit chain to target the flaws was initially technically challenging, even if not fundamentally impossible. The recent confirmation that real threat actors are already using working exploits in active attacks has added urgent pressure for public and private sector organizations alike to prioritize patching, to prevent unauthorized malicious access, service outages, and large-scale data breach events.

CISA did not disclose details on the specific threat actors conducting the ongoing exploitation in its public Monday statement, though the advisory was released shortly after independent cybersecurity researchers published verified evidence of real-world abuse of the PHP bugs.

The two vulnerabilities lay undetected and unaddressed for years, with a backstory that highlights growing new risks tied to AI-powered exploit development. The flaws were first uncovered two years ago, but the PHP Foundation’s maintainer team concluded at the time that there was no practically usable way for hackers to weaponize them, so patching work was deprioritized and the bugs were left unaddressed. That status shifted entirely earlier this year, when researchers at cybersecurity research firm Calif successfully built a working exploit chain that targets both dormant vulnerabilities with the assistance of specialized AI models.

This PHP flaw incident is part of a rapidly emerging, broader industry trend: countless previously undiscovered or long-deprioritized low-profile vulnerabilities across global software ecosystems are now turning into high-stakes attack vectors, as advances in AI models dramatically reduce the barrier to identifying, developing exploits for, and chaining together multiple unrelated flaws to achieve full remote system compromise. The event also casts a light on a longstanding structural security gap: PHP and many other legacy foundational web technologies that form the backbone of the modern internet have operated with chronically limited funding and under-resourced maintenance teams for years. For open source projects like PHP, tight budgets have made it impossible to regularly commission comprehensive, independent third-party security reviews that would have caught and patched critical flaws long before they could be weaponized for mass attacks.