CISA says attackers are exploiting critical PHP2Shell bugs
Original title: US government says hackers are now exploiting critical PHP web bugs
US civilian federal agencies have three days to patch passwordless remote break-ins in widely used PHP.
CISA confirmed that attackers are actively exploiting two critical PHP vulnerabilities known as PHP2Shell and ordered US civilian federal agencies to fix systems within three days. The bugs allow remote access to vulnerable internet-facing PHP systems without passwords. Maintainers shipped patches less than a week earlier after researchers at Calif found a practical exploit path with help from an AI model. The flaws had been known for about two years but left unpatched because maintainers then saw no practical attack.
Unconfirmed: CISA did not name the attackers, and the figure that PHP runs about 70% of web-facing servers is only reported.
- PHP is reportedly used by some 70% of web-facing servers.
- Some governments and large companies took sites offline to apply fixes.
- Researchers initially found a working exploit difficult but not impossible.
- CISA’s Monday statement did not identify who is exploiting the bugs.
- Calif used an AI model to chain a practical attack against the dormant flaws.
Impact: Passwordless remote break-in of vulnerable PHP systems
| Product | Affected |
|---|---|
| PHP | — |
- 1.US civilian federal agencies must fix affected PHP systems within three days.
- 2.Organizations should patch to reduce compromise, disruption, and data-breach risk.
- Vendors
- PHP
- Countries
- United States
From the original article
2 min read at techcrunch.com
The U. S. government cyber agency warns that hackers have figured out a way to exploit the popular PHP software, used in 70% of the web's software.
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.