CISA confirms PHP2Shell vulnerabilities now exploited in attacks

CISA has added PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies have been ordered to patch their systems by Thursday to mitigate the risk. The advisory underscores the urgency of addressing these flaws, which are being actively leveraged by threat actors. PHP2Shell vulnerabilities pose a significant risk to web-facing systems that rely on PHP-based environments. The move is part of CISA's ongoing effort to compel timely remediation of critical security issues across government infrastructure. Organizations beyond the federal sector are also encouraged to prioritize patching these vulnerabilities given their active exploitation status.