CISA orders fixes as PHP2Shell bugs face active attacks
First merged summary.
CISA says two critical PHP bugs are being exploited and gave US civilian agencies three days to patch.
CISA confirmed that attackers are actively exploiting two critical PHP vulnerabilities, collectively called PHP2Shell, and ordered US civilian federal agencies to fix internet-facing systems within three days. The bugs allow passwordless remote access. Maintainers shipped patches less than a week earlier after Calif found a practical exploit path with an AI model; the issues had been known for about two years and, according to Wiz, were left because humans could not exploit them. WIRED reports Cloudflare counted millions of attempts within hours of publication, while the PHP Foundation says it has not seen successful exploitation and many circulating exploits look ineffective. CISA did not name the attackers. Some governments and large companies took sites offline to apply fixes.
- CISA ordered US civilian agencies to patch within three days.
- Two critical bugs allow passwordless remote access to internet-facing PHP.
- Calif found a practical AI-assisted exploit path in early August.
- Cloudflare counted millions of attempts within hours of publication.
- PHP Foundation says it has not seen successful exploitation.
- PHP is reportedly used by about 70% of web-facing servers.
What each outlet adds
beyond the shared facts- WIREDCloudflare attempt volume, PHP Foundation skepticism, and 2024 complexity judgment.
- TechCrunchCISA’s three-day federal order and unnamed active exploitation.
- Vendors
- PHP
- Products
- PHP
- Organizations
- CISACalifPHP FoundationCloudflareOpenAIWiz
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 6d ago
WIRED · SecurityFirst report
PHP2Shell drew millions of exploit attempts; none succeeded, foundation says
Cloudflare saw millions of attempts within hours, while Calif, OpenAI and Wiz say AI helped turn long-known PHP issues into practical exploits.
- · 3d ago
TechCrunch · Security
CISA says attackers are exploiting critical PHP2Shell bugs
US civilian federal agencies have three days to patch passwordless remote break-ins in widely used PHP.