CISA confirms active exploitation of PHP2Shell flaws, orders federal patching
· Cybersecurity · United States
The U.S. Cybersecurity and Infrastructure Security Agency confirmed active exploitation of the recently patched PHP2Shell vulnerabilities by adding them to its Known Exploited Vulnerabilities catalog. Both flaws are rated 9.2 on the CVSS scoring system and enable unauthenticated remote code execution. CISA ordered federal agencies to patch their systems by Thursday. The listing signals that exploitation has moved beyond scanning into real attacks, and the short deadline gives agencies only days to remediate. The immediate effect is a government-wide patching push, with the catalog entry also guiding private-sector defenders on prioritization.
Why it matters：CISA's KEV listing with a hard deadline is the clearest signal that a widely deployed open-source component is under real attack, pushing both public and private operators to prioritize patching.
Key points
- Both PHP2Shell flaws carry a CVSS score of 9.2 and allow unauthenticated remote code execution.
- CISA added them to the Known Exploited Vulnerabilities catalog on Monday.
- Federal agencies were ordered to patch by Thursday.
Sources (original reporting)
More stories from this day
- Ransomware attack forces New Mexico hospital to divert ambulances, close clinics
- Apple backports exploited CoreGraphics zero-day fix to older iPhones
- Polymarket faces renewed CFTC probe over US access to offshore platform
- BNEF raises US energy storage forecast by 30% on hyperscaler demand
- Strike threat at eight LA-Long Beach terminals over watchmen walkout
- US intermodal squeeze: LA-LB rail backlog grows as UP adds containers