The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding active exploitation of two critical vulnerabilities in PHP, a popular web programming language used by about 70% of internet-facing servers. The agency has mandated that civilian federal agencies patch their systems within three days to mitigate potential breaches. These recently patched bugs, known collectively as PHP2Shell, allow hackers to remotely access vulnerable systems without authentication, creating significant security risks.

The PHP vulnerabilities gained heightened attention after their disclosure last week, with some large websites and governments temporarily taking systems offline to apply the fixes. Although the bugs were initially discovered two years ago, their practical exploitability remained uncertain until researchers at cybersecurity firm Calif demonstrated how attackers could leverage them, aided by an AI model. This AI-enabled breakthrough underscores growing concerns about how emerging technologies are accelerating the discovery and exploitation of long-standing software flaws.

While CISA has not revealed specific threat actors exploiting the PHP flaws, independent researchers have confirmed evidence of in-the-wild attacks targeting these issues. The vulnerabilities had persisted due to PHP's longstanding underfunding and limited security resources, with the nonprofit overseeing the software lacking the capacity for comprehensive audits. This scenario highlights broader challenges faced by critical open-source projects underpinning much of the internet, which remain vulnerable without sustained investment in security.

The incident serves as a stark reminder of the urgent need for organizations to apply security patches promptly, especially when flaws are designated as critical. As AI advances continue to enhance the capabilities of both defenders and attackers, the cybersecurity community must adapt by improving funding, detection, and response strategies to better safeguard web infrastructure and prevent malicious exploitation.