CISA orders federal agencies to patch active PHP2Shell exploits within three days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that threat actors are actively exploiting two critical vulnerabilities in the PHP programming language. In response, the agency has issued a binding directive requiring all civilian federal agencies to patch their systems within three days.

This urgent mandate arrives less than a week after the PHP maintainers released security updates to address the flaws. The confirmation of active exploitation shifts the situation from a theoretical risk to an immediate operational threat for millions of servers worldwide.

What happened

The vulnerabilities, collectively referred to as PHP2Shell, allow attackers to remotely execute code on vulnerable servers without requiring authentication. This means any internet-facing system running an unpatched version of PHP is at risk of being compromised simply by receiving a malicious request. CISA’s directive underscores the severity of the issue, forcing government entities to prioritize this fix over other scheduled maintenance or development work.

The path to this crisis began two years ago when researchers initially identified the bugs. At that time, the nonprofit foundation responsible for maintaining PHP determined that there was no practical method for attackers to exploit these flaws. Consequently, the issues were left unpatched while the software continued to evolve. However, earlier this year, researchers at the security firm Calif demonstrated that advances in artificial intelligence could chain these dormant vulnerabilities together, creating a working exploit.

Now that the barrier to entry has been lowered by AI-assisted discovery, the window for defense has closed rapidly. While CISA did not identify the specific groups behind the current attacks, the confirmation of in-the-wild exploitation suggests that automated scanners are likely hunting for vulnerable instances across the global internet. The widespread use of PHP, which powers an estimated 70% of web-facing servers, means the potential attack surface is massive.

Key details

• CISA has ordered U.S. civilian federal agencies to apply patches within three days of the announcement.
• The vulnerabilities, known as PHP2Shell, allow remote code execution without passwords.
• PHP is used by approximately 70% of web-facing servers, exposing a vast number of sites to risk.
• The bugs were discovered two years ago but were considered unexploitable until AI assistance changed the landscape.
• Researchers at the firm Calif developed the working exploit earlier this year using AI models.
• Some governments and large companies have taken sites offline temporarily to apply fixes safely.

Background

PHP is a server-side scripting language that has been a cornerstone of web development for decades. It powers major content management systems, e-commerce platforms, and custom enterprise applications. Because it is open source and widely supported, it became the default choice for many developers building dynamic websites. However, its age and ubiquity mean that many installations are legacy systems that may not be updated regularly.

The role of AI in this incident highlights a shifting paradigm in cybersecurity. Traditionally, finding complex exploit chains required significant human effort and time. Modern AI models can now analyze codebases to identify subtle interactions between different bugs that humans might miss. This capability turns previously low-risk, dormant vulnerabilities into critical threats almost overnight, reducing the time organizations have to react from months to days.

Why it matters

For teams managing self-hosted infrastructure, this incident serves as a stark reminder that "low risk" does not mean "no risk." Vulnerabilities that were once deemed theoretical can become practical weapons due to external technological advances. If your organization runs PHP-based applications, you are part of the 70% of web-facing servers potentially in the crosshairs. Delaying patches based on past assessments of exploit difficulty is no longer a viable strategy.

The speed of the response required here also impacts operational planning. A three-day deadline for federal agencies sets a precedent for how quickly critical infrastructure must respond. For private sector companies, especially those handling sensitive data, the expectation from customers and partners will be similar. Failure to patch quickly can lead to data breaches, service disruption, and reputational damage that far outweighs the cost of emergency maintenance.

Furthermore, this event highlights the fragility of under-funded open source projects. Many critical internet technologies rely on volunteer or limited-resource maintainers who cannot afford continuous, deep security audits. Organizations that depend on these tools must assume greater responsibility for their own security posture, including monitoring for emerging threats and maintaining the ability to deploy patches rapidly.

What you can do

• Inventory all servers and applications running PHP to identify which versions are currently in use.
• Apply the latest security patches released by the PHP maintainers immediately to all internet-facing systems.
• If immediate patching is not possible, consider taking affected services offline or placing them behind a web application firewall that can block known exploit patterns.
• Review logs for any unusual activity or unauthorized access attempts that may indicate a prior compromise.
• Update your incident response plan to account for rapid patching cycles driven by AI-discovered exploits.
• Subscribe to security advisories from CISA and the PHP project to receive future alerts as soon as they are published.