US government says hackers are now exploiting critical PHP web bugs

The U.S. government's cybersecurity agency, CISA, has reported that hackers are currently taking advantage of two critical security flaws in the widely-used PHP web software. The agency has instructed civilian federal agencies within the U.S. government to address the issue within three days. This warning was issued just days after the creators of PHP released patches for the vulnerabilities, which allow unauthorized remote access to vulnerable systems without requiring passwords.

PHP is reportedly utilized by approximately 70% of web-facing servers, making widespread websites and applications susceptible to attacks. Due to the severity of the bugs, some governments and large companies have temporarily taken their sites offline for remediation. Although rated as critical, these vulnerabilities are considered highly damaging if exploited; however, security researchers noted that developing a functional exploit to infiltrate vulnerable systems was initially difficult but feasible.

The confirmation of in-the-wild exploitation by hackers has put additional pressure on organizations to promptly patch their systems to avoid malicious compromises, disruptions, and data breaches. CISA did not disclose the identity of the hackers responsible for exploiting the bugs in its Monday statement. The bugs, named PHP2Shell, were initially discovered two years ago, yet researchers at security firm Calif recently discovered a method to exploit these dormant vulnerabilities using AI models.

The PHP software, part of many outdated web technologies, has been under-resourced and underfunded for years, making it difficult for open-source projects like PHP to allocate funds for security reviews that could have detected flaws earlier.