CISA confirms exploitation of two critical PHP vulnerabilities — TechCrunch

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are actively exploiting two critical vulnerabilities in PHP. U.S. civilian federal agencies were ordered to fix the issues in their systems within three days, TechCrunch reports.

Remote access without a password

PHP developers released fixes for two bugs less than a week before the CISA warning. The vulnerabilities allow remote intrusion into vulnerable systems via the internet without a password. PHP is reportedly used on about 70% of internet-accessible web servers, so the risk may affect major websites and applications.

Due to the critical level of danger, some governments and major companies temporarily shut down their websites to install the updates. Cybersecurity researchers noted that creating a working exploit for these bugs was initially difficult, although it remained possible. Confirmation of exploitation in real-world attacks reinforces the need to update systems promptly in order to prevent compromise, disruptions, and data leaks.

More current news is available on the UA.News Telegram channel Telegram.

PHP2Shell vulnerabilities

These bugs are known as PHP2Shell. They were discovered two years ago, but the nonprofit organization that maintains PHP stated at the time that there was no practical method of exploitation, so the vulnerabilities were not fixed. Earlier this year, specialists at Calif found a way to exploit both bugs using an artificial intelligence model.

CISA did not disclose who exactly is exploiting the vulnerabilities. TechCrunch notes that PHP is among the older web technologies that still power the internet and modern services, but open-source projects of this kind have lacked resources for security reviews for years.