CISA gives agencies days to patch critical PHP bugs

Federal agencies have until Thursday to patch recently surfaced vulnerabilities in widely used open-source web software, as the Cybersecurity and Infrastructure Security Agency warns the bugs are now being actively exploited.

CISA added the two vulnerabilities in the PHP open-source scripting software to the Known Exploited Vulnerabilities (KEV) catalog Monday. The catalog gives federal agencies an Oct. 29 deadline to apply the mitigations for the vulnerabilities, which are collectively known as “php2shell.”

Under a new binding operational directive issued earlier this year, CISA reserves the three-day patching deadline for the highest risk software vulnerabilities. CISA officials have said they want agencies to patch those types of severe bugs even faster than three days, if possible.

The disclosure of the PHP vulnerabilities last week sent software engineers across the world scrambling. The code works on most major operating systems, according to the National Security Agency, with its wide use creating an “environment ripe for exploitation.”

The vulnerabilities could allow attackers to take control of systems without prior access or authorization.

The addition of the vulnerabilities to CISA’s KEV catalog indicates that the cyber agency has confirmed “active exploitation” of the PHP bugs, rather than just scanning or proofs of concept.

Hemant Baidwan, the chief information security officer for Knox and former CISO at the Department of Homeland Security, said the three-day deadline “is an aggressive timeline” for agencies.

“Especially across large federal environments where PHP may be embedded in applications, containers, appliances, or third-party products,” Baidwan added in comments to Federal News network. “The challenge is not just patching. Teams first have to identify where the vulnerable component exists, determine whether it is externally exposed, understand the mission impact, test the fix, and validate that remediation actually worked.”

Ramy Rahman, senior principal solutions engineer at ArmorCode, said it’s possible agencies can meet the deadline, but “the biggest challenge will be the versions of PHP they’re running, and the dependencies tied to them.” He said administrator should prioritize upgrading to patched versions of PHP.

“The reality is that many organizations are likely running older, unsupported versions, which introduces the additional complexity of upgrading applications, addressing compatibility issues, or working with vendors to obtain supported fixes,” Rahman added.

While PHP is known for powering 70% of websites across the world, the scripting language also can sit behind business-critical applications, administrative interfaces and systems that support essential services, according to Matt Hull, vice president of cyber intelligence and response at the NCC Group.

“It’s been a while since we’ve seen a situation like this, but this is about as serious as vulnerabilities get,” Hull said. “Patching is essential, but it doesn’t guarantee safety. If attackers have already exploited the vulnerability and gained access, they may have installed backdoors to get back in once the patch has been applied.”

Several cyber experts echoed that sentiment, urging organizations to not just apply the patches, but to check whether the bugs have already been exploited.

“Teams should be reviewing logs, looking for indicators of exploitation, hunting for abnormal behavior, and determining whether vulnerable systems may have been compromised before they were patched,” Baidwan said. “The question is not just ‘Did we patch it?’ It is also “Were we exploited before we patched it?’”

While the vulnerabilities were widely revealed last week, the PHP Foundation said it identified the “first signs” of problem behind the bugs in 2024. In recent months, the foundation said it was working with security engineers and major technology firms on coordinated disclosures around the vulnerabilities. The bugs were leaked in online forums two days before the planned public disclosure of the vulnerabilities, according to the foundation.

While humans first identified the vulnerabilities, experts say the situation is an example of how artificial intelligence could help identify and exploit such software bugs.

“The window to respond has shrunk dramatically,” Hull said. “A few years ago, attackers might have taken weeks to exploit a vulnerability. Now, it can be days or hours. Every organization needs to identify if PHP is running in its systems and map those systems against critical business services. Which systems can be shut down and which can’t, and how will your organization continue to run offline? Are your backups tested, your communications plans ready and your incident response procedures exercised?”

Baidwan said meeting Thursday’s patch deadline is just the start of the response to the vulnerabilities.

“Agencies will need to continue reviewing historical activity, looking for persistence or follow-on activity, validating affected assets, and monitoring for new techniques and indicators,” he said. “There is also a supply chain challenge because vulnerable PHP components may exist inside applications, containers, or third-party products that agencies do not immediately identify through traditional vulnerability scanning.”

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.