A week after an emergency fix, two holes in software that runs much of the web have moved from a worry to a confirmed weapon. The Cybersecurity and Infrastructure Security Agency added the pair to its Known Exploited Vulnerabilities catalog on Monday, a list that binds federal civilian agencies to rapid repairs under a standing directive, the agency said in a release. The catalog is the agency's running tally of flaws it has evidence are being used in real attacks. An entry starts a compliance clock inside government and signals to companies that the threat is no longer theoretical.
PHP is a decades-old scripting language that processes forms, pulls records from databases and assembles pages for publishing systems such as WordPress and Drupal. Because the defect sits in the language rather than in any plugin, keeping a site's own code current offers no protection. The software underpins an estimated 70% of web-facing servers, and the flaws, known collectively as PHP2Shell, were found two years ago but left unpatched because maintainers saw no practical exploit, until researchers at security firm Calif built one this year with help from an AI model, TechCrunch reported. That sequence has become a reference point in a wider debate. Thinly funded open-source projects have long struggled to pay for security reviews, and AI tools are making it cheaper to revive weaknesses dismissed years ago.
The first response came from the people who maintain the language. The PHP project shipped security releases for every supported version, said configuration changes only reduce exposure and that updating is the sole complete fix, and offered minimal backports for retired branches, according to its advisory. Gauging the damage has proved harder than shipping the patch. Two security firms retracted early claims of successful intrusions after concluding they had seen scanning and failed attempts, Nextgov reported. For agencies, the remaining work is largely inventory: finding every copy of PHP, including instances bundled inside other products, and dealing first with those reachable from the internet. Systems that cannot be updated quickly are candidates to be taken offline.