CISA Gives Federal Agencies 3 Days to Patch Actively Exploited PHP Bugs

By Daniel Okafor

U.S. cybersecurity agency CISA has confirmed hackers are actively exploiting two critical vulnerabilities in PHP and has ordered civilian federal agencies to patch their systems within three days. The mandate landed on Monday, less than a week after the maintainers of PHP released fixes for the bugs.

The flaws allow hackers to remotely break into a vulnerable system over the internet without needing passwords. PHP reportedly runs on some 70% of web-facing servers. That footprint puts major websites and applications at risk. The severity prompted some governments and large companies to take their sites offline while they applied patches.

Why is this warning so urgent?

Both bugs carry a critical rating, meaning they can cause serious damage when exploited. Security researchers initially found that building a working exploit was hard — but not impossible. That barrier has now fallen.

CISA's confirmation of in-the-wild exploitation changes the calculation for every organization running vulnerable systems. Researchers had already found evidence of attacks before the agency's statement. Confirmed exploitation puts pressure on organizations to patch, or risk malicious compromises, disruption, and data breaches.

CISA did not say who is behind the attacks. Its Monday statement offered no attribution. The agency's alert followed shortly after independent researchers reported signs of exploitation.

What are the PHP2Shell bugs?

The vulnerabilities, tracked under the name PHP2Shell, exploit weaknesses in the software that went unnoticed for years. The story of how they surfaced matters as much as the patches themselves.

Researchers first uncovered the two bugs two years ago. The nonprofit foundation that maintains PHP reviewed them and concluded there was no practical way for hackers to exploit them. The flaws stayed unpatched on that basis. Earlier this year, that judgment collapsed. Researchers at security firm Calif found a way to weaponize the two dormant vulnerabilities — with the assistance of an AI model.

The mechanism is the point here. An AI system helped chain together flaws that humans had dismissed as theoretical. The result is a working remote compromise of software running most of the web.

Does AI change the risk for old vulnerabilities?

Yes, and CISA's three-day deadline is the practical proof. The two PHP bugs belong to a much larger pool of vulnerabilities that were never discovered, or were deprioritized for years. Advances in AI models now make it possible to find and exploit those flaws, including by chaining multiple weaknesses together into one attack path.

Bugs once judged unusable can no longer be treated as safe. That shift forces maintainers and security teams to re-examine old vulnerability reports rather than leave them on the shelf.

The PHP episode shows the economics of the problem too. PHP is one of many aging web technologies that keep the internet and modern services running. These projects have been under-resourced and under-funded for years. That funding gap made it difficult for open-source projects like PHP to pay for security reviews that might have caught the flaws sooner.

What happens next?

Federal agencies now face a hard deadline measured in days. Everyone else running PHP faces the same exposure without a formal mandate. The patch landed less than a week ago, so a large share of the world's web servers likely still run vulnerable code.

The longer-term question concerns the backlog. If AI models can revive dormant bugs, every open-source project that skipped a security review because of budget constraints is now holding inventory for attackers. Expect more agencies and companies to take systems offline while they patch — the PHP2Shell case suggests that practice will repeat as AI-driven exploitation spreads.