CISA confirmed active exploitation of critical PHP vulnerabilities and gave federal agencies three days to patch them
The American cybersecurity agency CISA reported that hackers have begun using two critical PHP vulnerabilities (PHP2Shell) in real-world attacks, allowing remote takeover of servers without a password. The agency added the bugs to its catalog of known exploited vulnerabilities and required US civilian federal agencies to patch them within three days. The vulnerabilities were discovered two years ago but were considered impractical to exploit until researchers at Calif found a way to exploit them using AI.
Otabek Yusupov