01
Security
CISA Confirms Active Attacks on Two PHP2Shell Flaws Enabling Remote Code Execution
Millions of PHP services remain exposed until operators move to the fixed releases, which federal agencies were ordered to apply by October 29, 2026.
Millions of PHP services remain exposed until operators move to the fixed releases, which federal agencies were ordered to apply by October 29, 2026.
Bundled copies of the library are not fixed by a system update, so applications and container images need rebuilding after patching.
Server operators running affected configurations must disable one setting now, while attackers have so far mostly probed the PHP2Shell flaws without confirmed compromises.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
More than 400 SMA1000 appliances are visible online, leaving exposed systems under active attack attempts.
Self-hosted customers must patch or restrict access now; cloud users are not affected.