US government says hackers are now exploiting critical PHP web bugs
News Source
β’Tue, 27 Oct 2026 14:40:39 +0000
π° What Happened
A US government agency says hackers are now using two serious flaws in PHP, a coding language that runs a huge share of the web. The agency, CISA, told civilian federal departments to fix their systems within three days.
The flaws were patched less than a week ago. They let an attacker break into a server over the internet without a password. PHP is used by roughly 70% of web-facing servers, so the risk reaches far past government sites. Some governments and big companies took their sites offline to fix them.
π The Backstory
PHP was created in the mid-1990s and still powers tools like WordPress, which runs a large share of the world's websites. That reach is the problem. One flaw can sit unnoticed on millions of machines, and many owners never install updates.
The two bugs, nicknamed PHP2Shell, went unseen for years and were first identified about two years ago, according to the article. CISA keeps a public list of flaws that are being used in real attacks and sets deadlines for agencies. Security teams watch that list closely because it marks the moment a bug becomes a real break-in.
π― Why It Matters
If your bank, shop or council runs old PHP, this is why a site suddenly goes down for urgent fixes. Patching fast is the difference between a warning and a breach.
A US government agency says hackers are now using two serious flaws in PHP, a coding language that runs a huge share of the web. The agency, CISA, told civilian federal departments to fix their systems within three days.
The flaws were patched less than a week ago. They let an attacker break into a server over the internet without a password. PHP is used by roughly 70% of web-facing servers, so the risk reaches far past government sites. Some governments and big companies took their sites offline to fix them.
PHP was created in the mid-1990s and still powers tools like WordPress, which runs a large share of the world's websites. That reach is the problem. One flaw can sit unnoticed on millions of machines, and many owners never install updates.
The two bugs, nicknamed PHP2Shell, went unseen for years and were first identified about two years ago, according to the article. CISA keeps a public list of flaws that are being used in real attacks and sets deadlines for agencies. Security teams watch that list closely because it marks the moment a bug becomes a real break-in.
If your bank, shop or council runs old PHP, this is why a site suddenly goes down for urgent fixes. Patching fast is the difference between a warning and a breach.