CISA reports active exploitation of two critical PHP flaws
IT Home reported that the US Cybersecurity and Infrastructure Security Agency confirmed active exploitation of two critical vulnerabilities in PHP web software and ordered US federal civilian agencies to patch affected systems within three days. PHP maintainers released fixes shortly before the warning. Security researchers had reported finding evidence of real-world exploitation, while Calif researchers separately said they used an AI model to devise a method for exploiting the vulnerabilities. CISA did not identify the specific organizations or systems targeted, and the report did not establish that the observed attacks used the AI-assisted method.
The vulnerabilities allow remote compromise without a password, and confirmed exploitation has prompted a three-day federal remediation deadline. This supports the immediate operational risk to organizations running affected PHP systems.