CISA says attackers are exploiting critical PHP2Shell bugs

CISA confirmed active exploitation of two critical PHP bugs and gave US civilian agencies three days to patch.

CISA says attackers are exploiting two critical PHP flaws known as PHP2Shell, which allow passwordless remote access to internet-facing systems, and ordered US civilian federal agencies to fix them within three days. PHP shipped patches after a Tuesday advisory; The Verge says they arrived at 10 a.m. ET. watchTowr says both bugs are remote code execution from PHP 5 onward and rated 9.2. Sites including Wikipedia, the Internet Archive, 4chan and DeviantArt went offline at least temporarily. How long the flaws existed and who found them is disputed: The Verge says roughly 20 years and credits a Calif researcher using GPT-5.6 Sol, while TechCrunch says about two years and that human researchers found them and used AI to exploit them.