01
Security
CISA Flags Two Critical PHP Flaws as Actively Exploited Ahead of Patch Deadline
Attackers were already exploiting the PHP2Shell flaws in the wild before fixed releases were published, leaving unpatched servers exposed.
Attackers were already exploiting the PHP2Shell flaws in the wild before fixed releases were published, leaving unpatched servers exposed.
Many sites were running end-of-life PHP versions, so the one-point-release fix could not be applied quickly everywhere.
Organisations running unpatched PHP servers face active exploitation, and defenders are being told to watch for a specific pattern of errors in their logs.
The bugs remain unexploited so far, but AI is shortening the time between disclosure and attack for under-resourced teams.
Server operators running affected configurations must disable one setting now, while attackers have so far mostly probed the PHP2Shell flaws without confirmed compromises.
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.