CISA Orders Urgent Fixes as Hackers Exploit Critical PHP2Shell Flaws
CISA says hackers are exploiting two critical PHP2Shell flaws in software used by about 70% of web servers, with federal patches due within three days.
Summary
CISA confirmed on Monday that hackers are actively exploiting two critical PHP vulnerabilities known as PHP2Shell. The flaws allow remote internet attacks without passwords and affect software reportedly used by about 70% of web facing servers. Civilian federal agencies must patch within three days. PHP maintainers released fixes less than a week before the warning, while some governments and large companies took websites offline to secure them. The attackers remain unidentified, and exploitation raises the risk of system compromise, disruption and data breaches.
Researchers initially considered a working exploit difficult, but possible. The vulnerabilities were discovered two years ago and left unpatched after the nonprofit PHP foundation concluded there was no practical exploitation method. Earlier in 2026, security firm Calif used an AI model to find a way to exploit both flaws. The case shows how AI can revive dormant vulnerabilities and chain multiple weaknesses, increasing pressure on aging, underfunded open source projects such as PHP to finance deeper security reviews.
Positives
- PHP maintainers released patches for both critical vulnerabilities less than a week before CISA confirmed active exploitation.
- CISA gave civilian federal agencies a three day deadline to secure affected systems.
- Calif identified a practical exploitation method earlier in 2026, enabling defenders to reassess vulnerabilities previously considered impractical.
- Some governments and large companies took websites offline to apply fixes and reduce exposure.
Risks & concerns
- PHP2Shell enables remote compromise over the internet without requiring passwords.
- About 70% of web facing servers reportedly use PHP, creating a potentially broad attack surface.
- Two vulnerabilities remained unpatched for two years because maintainers believed practical exploitation was unavailable.
- CISA has not identified the hackers exploiting the flaws or disclosed details about their activity.
- AI models can make dormant flaws exploitable by finding attack methods and chaining multiple vulnerabilities.
- Aging, underfunded open source technologies such as PHP can struggle to finance security reviews that might uncover flaws sooner.