CISA Designates PHP2Shell Vulnerabilities as Actively Exploited, Sets Federal Patch Deadline

On Tuesday, the Cybersecurity and Infrastructure Security Agency (CISA) disclosed that the PHP2Shell web‑shell flaws are now listed among its actively exploited security weaknesses, directing every federal agency to implement remediation steps by Thursday.

PHP2Shell is a hostile script that attackers can upload to insecure PHP‑driven web apps, giving them the power to run arbitrary commands on the host server. Researchers have monitored the tool since early 2023, highlighting how simply it can be deployed and its ability to evade basic input‑validation mechanisms.

These flaws, catalogued under multiple CVE identifiers, impact a variety of obsolete PHP releases still running on numerous legacy government sites and internal systems. An attacker usually finds an unprotected file‑upload point, inserts the PHP2Shell payload, and then leverages it to steal data, alter configurations, or secure persistent footholds.

In federal information environments, the danger escalates as hijacked servers can become launch pads for wider network breaches, risking exposure of sensitive citizen information or interruption of essential services. Historical web‑shell incidents have shown how rapidly adversaries can pivot laterally after compromising a single machine.

Consequently, CISA has added the PHP2Shell problems to its Known Exploited Vulnerabilities (KEV) catalog, which obligates mandatory remediation under current federal cyber‑security directives. Agencies must confirm that patches or mitigations are in place, record their compliance, and submit the status to cybersecurity leadership before Thursday.

Industry analysts note that the order highlights an increasing focus on swift patch management for broadly used open‑source components. Public‑sector security teams are anticipated to perform inventory audits, install vendor‑released updates, or deploy compensating measures like web‑application firewalls when immediate patching is impractical. The action also reinforces that even familiar scripting languages can turn into attack vectors if left outdated, spurring demands for more proactive lifecycle stewardship of legacy code bases.