The U.S. government’s cybersecurity agency has ordered all civilian federal systems to apply patches within three days after confirming that cybercriminals are actively exploiting two critical vulnerabilities in PHP web software. These flaws—which bypass passwords and allow remote takeover—are said to put roughly 70% of websites at risk.
Discovery, Delay, and Risk
The two flaws—dubbed “PHP2Shell”—were originally discovered around two years ago but were deemed unexploitable at the time. PHP’s maintainers had held off on patching, arguing there was no practical attack vector. That changed earlier this year when researchers, aided by AI tools, demonstrated how the bugs could be chained together to yield remote code execution, effectively giving hackers control of affected systems without needing credentials.
PHP2Shell covers vulnerabilities that had been lying dormant until advances in AI-based analysis made vulnerabilities easier to uncover. The PHP open-source project, like many long-used web technologies, has faced shortages of resources to fund security audits—making long-standing flaws harder to root out until they become active threats.
Urgency, Response, and Fallout
After patching updates were issued less than a week ago, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed confirmed in-the-wild exploits, prompting its urgent directive to federal civilian agencies. The agency has not yet disclosed who is behind the attacks.
Some governments and organizations already took websites offline to apply the fixes, while others remain exposed. Researchers emphasize that while the bugs are classified as critical, creating working exploits was initially hard — but now that actual attacks are underway, the time to act is limited.
The warning underscores how aging foundational software—used by billions of users globally—can accumulate vulnerabilities over time, especially when funding and oversight are lacking. Once thought harmless, these PHP2Shell bugs now represent a serious risk due to new methods for uncovering old flaws.
The growing ability for AI models to discover and combine vulnerabilities turns outdated and under-resourced web infrastructure into a target-rich environment. For PHP, a tool integral to the web, this moment represents a wake-up call: patch now, or face rising costs later.
