CISA Flags PHP2Shell Flaws as Actively Exploited, Urges Federal Patch Deadline

The Cybersecurity and Infrastructure Security Agency (CISA) announced on Tuesday that the PHP2Shell web‑shell vulnerabilities have been added to its catalog of actively exploited security flaws, and it has ordered all federal agencies to apply remediation measures by Thursday.

PHP2Shell is a malicious script that can be uploaded to vulnerable PHP‑based web applications, granting attackers the ability to execute arbitrary commands on the underlying server. Security researchers have been tracking the tool since early 2023, noting its ease of deployment and its capacity to bypass basic input validation checks.

The vulnerabilities, identified under several CVE numbers, affect a range of outdated PHP versions that remain in use across many legacy government websites and internal applications. Exploitation typically involves an attacker locating an unsecured file‑upload endpoint, planting the PHP2Shell payload, and then using it to exfiltrate data, modify configurations, or establish persistent access.

For federal information systems, the risk is heightened because compromised servers can serve as footholds for broader network intrusion, potentially exposing sensitive citizen data or disrupting critical services. Past incidents involving web shells have demonstrated how quickly attackers can move laterally once a single host is compromised.

In response, CISA has placed the PHP2Shell issues in its Known Exploited Vulnerabilities (KEV) catalog, a list that triggers mandatory remediation under existing federal cybersecurity directives. Agencies are required to verify that patches or mitigations are applied, document compliance, and report status to the agency’s cybersecurity leadership before the Thursday deadline.

Industry observers say the directive underscores the growing emphasis on rapid patch management for widely deployed open‑source components. Security teams across the public sector are expected to conduct inventory checks, apply vendor‑issued updates, or implement compensating controls such as web‑application firewalls where immediate patching is not feasible. The move also serves as a reminder that even well‑known scripting languages can become attack vectors if not kept current, prompting calls for more proactive lifecycle management of legacy code bases.