The United States Cybersecurity and Infrastructure Security Agency has confirmed that hackers are actively exploiting two critical vulnerabilities in PHP, a widely used web programming language, and has directed civilian federal agencies to patch affected systems within three days.
The urgent directive comes less than a week after PHP developers released security updates to address the flaws, which could allow attackers to remotely access vulnerable systems over the internet without requiring passwords.
PHP reportedly runs on about 70 per cent of web-facing servers, exposing major websites and applications to potential attacks. The severity of the vulnerabilities has prompted some governments and large companies to take their websites offline while applying security fixes.
Although the flaws are rated critical, security researchers initially said exploiting them successfully would be challenging, but not impossible. Confirmation that hackers are now actively exploiting the vulnerabilities has increased the urgency for organisations to patch affected systems to prevent unauthorised access, service disruptions and data breaches.
CISA did not identify those responsible for exploiting the vulnerabilities in its Monday statement. However, the warning followed reports from security researchers who had found evidence of active exploitation.
Known as PHP2Shell, the flaws affect PHP and had remained unaddressed for years.
The vulnerabilities were first discovered two years ago, but the nonprofit foundation responsible for maintaining the software reportedly considered them impractical to exploit, leaving them unpatched.
That changed earlier this year when researchers at cybersecurity firm Calif, with the assistance of an artificial intelligence model, discovered a way to exploit the two dormant vulnerabilities.
The two PHP vulnerabilities highlight the risks posed by countless security flaws that remain undiscovered or have been overlooked for years. Advances in artificial intelligence are making it easier for researchers and attackers to identify and exploit such weaknesses, including by combining multiple vulnerabilities to launch more sophisticated attacks.
