CISA Gives Federal Agencies Three Days to Patch Exploited PHP Bugs

CISA has ordered U.S. civilian federal agencies to patch two critical PHP vulnerabilities within three days, after confirming hackers are now actively exploiting the bugs in the wild. That's an unusually tight deadline, and it signals how seriously the U.S. cybersecurity agency takes this one.

The bugs allow attackers to remotely break into vulnerable systems over the internet without needing passwords. PHP, a decades-old web programming language, reportedly runs on some 70% of web-facing servers — meaning a large share of the public web sits on potentially affected infrastructure. The severity already pushed some governments and large companies to take their sites offline entirely while they patched.

The warning landed less than a week after PHP's maintainers shipped fixes for the two flaws. Speed matters here. Security researchers noted that building a working exploit was initially challenging — but not impossible. Confirmed exploitation changes that calculus entirely.

Who is behind the attacks?

CISA didn't say. In its Monday statement, the agency offered no details on the actors involved. But the warning came soon after independent security researchers said they had found evidence the PHP bugs were already being exploited.

For practitioners, that gap matters. An active, unnamed threat usually means the agency is seeing real telemetry rather than responding to a proof-of-concept.

What does this change for organizations still unpatched?

Plenty. Before this week, you could argue the bugs were critical on paper but hard to weaponize in practice. Now that attackers have crossed that threshold, unpatched systems face genuine risk of malicious compromise, disruption, and data breaches. CISA's three-day clock effectively applies to private-sector teams too, even though the directive only binds federal civilians. If you run PHP-facing infrastructure, treat this as your deadline.

How AI turned dormant bugs into live weapons

The pair of flaws, tracked as PHP2Shell, sat unnoticed for years. They were actually uncovered two years ago — but the nonprofit foundation that maintains PHP said at the time there was no practical way for hackers to exploit them, so the bugs went unpatched.

That changed earlier this year. Researchers at security firm Calif found a way to exploit the two dormant vulnerabilities with the assistance of an AI model.

That detail deserves your attention. These two PHP bugs are among countless vulnerabilities that remain undiscovered or have been deprioritized for years — and that now pose fresh risk because AI models can find and exploit flaws, including by chaining multiple weaknesses together.

The old triage logic — "theoretically exploitable, so we'll fix it later" — is weakening. AI has compressed the distance between a dormant bug and a working attack.

The funding problem behind the patch

PHP belongs to a class of aging web technologies that quietly keep the internet and modern services running. Yet these projects have been under-resourced and under-funded for years. That chronic squeeze makes it hard for open-source efforts like PHP to pay for security reviews that might have surfaced these flaws much sooner.

In other words, the ecosystem patched a crisis this week, but the structural condition that let two critical bugs sit dormant for two years hasn't changed.

Expect the pressure to hold. With active exploitation confirmed and AI-assisted vulnerability discovery accelerating, organizations that still treat open-source patching as a background task will find the window between disclosure and attack shrinking — and for these two PHP bugs, that window has already closed.