CISA orders US agencies to patch critical PHP vulnerabilities in 3 days

Critical vulnerabilities under active attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers are exploiting two critical vulnerabilities in PHP, a widely used web software. The flaws, dubbed PHP2Shell, allow remote access without passwords and affect an estimated 70% of web-facing servers globally.

According to CISA, the vulnerabilities went undiscovered for years but became exploitable recently due to AI-assisted research. The agency did not disclose who is behind the ongoing attacks or provide further details about the exploitation.

The severity of the bugs led some governments and major companies to take websites offline to apply fixes. Security researchers reported evidence of active exploitation, prompting CISA’s emergency directive.

AI-assisted exploitation and delayed patches

The PHP vulnerabilities were initially identified two years ago, but the nonprofit organization maintaining PHP stated at the time that there was no practical way for hackers to exploit them. As a result, the bugs remained unpatched.

Security researchers at Calif later discovered a method to exploit the vulnerabilities using an AI model, making it possible for attackers to develop working exploits. This development highlights how AI is accelerating the exploitation of dormant software flaws.

The incident underscores the challenges faced by aging web technologies like PHP, which have been under-resourced and under-funded for years. Limited funding makes it difficult for open-source projects to conduct thorough security reviews, leaving critical vulnerabilities unaddressed for extended periods.

AI’s role in vulnerability exploitation

This development follows earlier reporting on how AI tools are reshaping the timeline for vulnerability discovery and exploitation. Security teams observed AI-assisted attack attempts targeting PHP2Shell within hours of disclosure, though no large-scale breaches were confirmed at the time.

Amazon’s MadPot honeypot network detected exploit attempts targeting the same PHP vulnerabilities four days before patches were publicly released. Cloudflare and other security firms reported a surge in exploit traffic, reaching millions of attempts shortly after disclosure.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators running PHP-based systems, this is a direct wake-up call. The three-day patching deadline for U.S. federal agencies may not legally apply to private companies, but it signals how urgent CISA considers the threat. A successful exploit grants remote access without authentication, meaning any unpatched server is effectively an open door for attackers.

The AI-assisted exploitation also changes the game for vulnerability management. Flaws once considered theoretical or too complex to exploit are now within reach of attackers using AI tools. Teams relying on open-source software like PHP must assume faster exploitation timelines and prioritize patching even for dormant bugs.

The broader takeaway is about technical debt. PHP powers a significant portion of the web, yet its maintenance has been chronically under-funded. Founders building on similar open-source infrastructure should evaluate whether their stack is receiving the security attention it needs—or risk being the next target.

Related on Lazyfounder

• Calif
• PHP
• More technology news
• AI tools accelerate exploitation of PHP vulnerabilities within hours of disclosure
• Amazon says PHP2Shell attacks began four days before patches