The U.S. cybersecurity agency CISA has confirmed that hackers are actively exploiting two critical security vulnerabilities in widely used PHP web software and has ordered civilian federal agencies within the U.S. government to patch their systems within the next three days.
Just under a week before this emergency patch alert was issued, the long-standing maintainers of the PHP web programming language released fixes for these two vulnerabilities. These flaws allow hackers to remotely compromise vulnerable systems over the internet without needing a password. Reports indicate that PHP software is used by approximately 70% of web-facing servers, putting a vast number of websites and applications at risk. The severity of these vulnerabilities has prompted some governments and large corporations to take their websites offline to apply the fixes.
Although these vulnerabilities are rated as "critical," meaning they could cause significant damage if exploited, security researchers say that initially developing viable attack methods was not easy—but not impossible. The confirmation of real-world attacks now increases pressure on organizations to patch their systems quickly to prevent malicious intrusions, service disruptions, and data breaches.
CISA did not provide details on who was exploiting these vulnerabilities in its Monday statement, but shortly before the statement was released, security researchers indicated they had found evidence that the PHP vulnerabilities were being exploited.
These exploits, known as PHP2Shell, target flaws in software that went undetected for years. They were first discovered two years ago, but the nonprofit foundation responsible for maintaining the software stated at the time that hackers had no practical means to exploit them, so no patches were issued. Earlier this year, researchers at the security firm Califf, with the help of an AI model, found viable methods to exploit these long-dormant vulnerabilities.
These two vulnerabilities in PHP are just a small part of countless others that have yet to be discovered or have been deprioritized for years; as AI models improve in their ability to detect and exploit vulnerabilities—including by chaining multiple flaws—these vulnerabilities now pose significant risks.
PHP is one of many outdated web technologies that underpin the internet and modern systems, but have suffered from insufficient resources and funding for years, making it difficult for open-source projects like PHP to afford security reviews that could have identified vulnerabilities earlier.