US government warns of active exploitation of critical PHP web bugs

Key facts

• Hackers are actively exploiting critical PHP web bugs, CISA confirmed.
• Civilian federal agencies must patch systems within three days.
• The vulnerabilities, PHP2Shell, allow remote system access without passwords.
• PHP software is used by approximately 70% of web-facing servers.
• AI models have enabled exploitation of previously unexploitable vulnerabilities.

The US Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning on October 27, 2026, confirming that hackers are actively exploiting two critical vulnerabilities in the widely used PHP web software. Civilian federal agencies have been given three days to patch their systems. These bugs, which allow remote system access without passwords, were discovered two years ago but have recently become exploitable due to advances in AI models' ability to find and chain vulnerabilities. PHP is reportedly used by about 70% of web-facing servers, putting numerous websites and applications at risk.