CISA has confirmed that hackers are actively exploiting two critical PHP2Shell vulnerabilities in the PHP web programming language and has ordered civilian federal agencies to patch their systems within three days. The bugs, which allow remote code execution without passwords, were patched by the PHP maintainers less than a week ago after researchers at Calif demonstrated an AI-assisted exploit. PHP powers roughly 70% of web-facing servers, prompting some governments and large companies to take sites offline while they apply the fixes. Although the flaws were discovered two years ago and initially deemed impractical to exploit, in-the-wild attacks now show they can be weaponised, raising the risk of malicious compromises, disruption and data breaches across a broad swath of internet services. 1