ChordNews
← All news

CISA says PHP2Shell vulnerabilities are now exploited in attacks

By ChordNews · First written (new coverage )

CISA confirms PHP2Shell under attack as researchers clock successful exploits
Image: theregister.com
Comments 0

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday, according to BleepingComputer. TechCrunch reports that the agency warns hackers have figured out a way to exploit popular PHP software, which it says is used in 70% of the web's software. The Register reports that both critical PHP flaws are now on the agency's exploited list, and that infosec researchers confirm hackers are getting working shells. The reports are based on excerpts, so the full list of affected products and flaws is not covered here.

This continues an earlier story: CISA Warns Attackers Are Exploiting Plex Media Server Flaws in Plex2Shell Attacks

Later: CISA warns federal agencies to patch Fragnesia Linux kernel flaw chained in PHP2Shell attacks

Timeline

  1. BleepingComputer

    Source ↗

    BleepingComputer reports that CISA has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.

  2. TechCrunch

    Source ↗

    TechCrunch reports that the U.S. government cyber agency warns hackers have figured out a way to exploit the popular PHP software, which it says is used in 70% of the web's software.

  3. The Register

    Source ↗

    The Register reports that both critical PHP flaws have landed on the agency's exploited list as infosec pros confirm hackers are getting working shells.

Comments

No comments yet.

    to like and comment.

    © 2026 ChordNews