US government says hackers are now exploiting critical PHP web bugs

The U.S. Cybersecurity and Infrastructure Security Agency said Monday that hackers are actively exploiting two critical vulnerabilities in PHP, the web programming language used on a large share of internet-facing servers, and ordered civilian federal agencies to patch their systems within three days. The confirmation of real-world attacks raises the pressure on organizations running vulnerable PHP installations to update quickly. PHP is reportedly used by about 70% of web-facing servers, according to the source reporting.

The warning arrived less than a week after the maintainers of PHP released fixes for the two flaws. The bugs allow an attacker to break into a vulnerable system remotely over the internet without needing passwords. Their severity led some governments and large companies to take their websites offline while they applied the patches.

CISA did not disclose who was carrying out the exploitation in its Monday statement. The agency's confirmation followed disclosures from security researchers who said they had found evidence that the PHP bugs were being exploited in the wild. Security researchers had earlier noted that building a working exploit was difficult at first, though not impossible.

The vulnerabilities, known as PHP2Shell, are tied to flaws that sat undiscovered in the software for years. They were first identified two years ago, but the nonprofit foundation that maintains PHP judged that there was no practical way for attackers to exploit them, so the bugs went unpatched. That changed earlier this year, when researchers at security firm Calif found a way to exploit the two dormant vulnerabilities with help from an AI model.

The PHP case illustrates a broader problem: numerous vulnerabilities remain undiscovered or have been deprioritized for years, and advances in AI models' ability to find and chain flaws together are now changing the risk they pose. PHP is among the aging web technologies that underpin the internet and modern technology but have been under-resourced and under-funded for years, making it hard for open-source projects like PHP to pay for the security reviews that might have caught the flaws sooner.

For U.S. federal civilian agencies, the three-day window makes patching a near-term requirement. For private organizations and website operators, the confirmed exploitation means the same fixes are available and the same exposure applies.

More cybersecurity news from TechManNews.