CISA Says Hackers Exploiting Critical PHP Bugs, Orders Federal Patch Within Three Days

CISA’s Monday statement came less than a week after the makers of the decades-old PHP web programming language released patches for the two bugs. PHP is reportedly used by about 70% of web-facing servers, putting major websites and applications at risk, and the severity of the bugs prompted some governments and large companies to take their sites offline to fix them. CISA did not provide details about who was exploiting the bugs, but its statement came soon after security researchers said they found evidence that the PHP bugs were being exploited.

Security researchers said that developing a working exploit to hack into vulnerable systems was initially challenging, but not impossible. Confirmed in-the-wild exploitation now puts extra pressure on organizations to patch their systems to prevent malicious compromises, disruption and data breaches.

The bugs, known as PHP2Shell, exploit vulnerabilities that went undiscovered for years. They were initially uncovered two years ago, but the nonprofit foundation that maintains the software said there was no practical way for hackers to exploit them, leaving the bugs unpatched. That was until earlier this year, when researchers at security research firm Calif uncovered a way to exploit the two dormant vulnerabilities with the assistance of an AI model.

The two bugs in PHP are among countless vulnerabilities that have not yet been discovered or have been deprioritized for years but now pose a risk due to advances in AI models’ ability to find and exploit vulnerabilities, including by chaining multiple flaws together. PHP is one of many aging web technologies that help keep the internet and modern technologies running, but that have been under-resourced and under-funded for years, making it difficult for open-source projects like PHP to pay for security reviews that might have uncovered flaws sooner.