US government says hackers are now exploiting critical PHP web bugs
- ID
- 39965
- Status
- summarized
- Published
- 27 Oct 2026, 10:40 PM
- Fetched
- 27 Oct 2026, 10:47 PM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/10/27/us-government-says-hackers-are-now-exploiting-critical-php-web-bugs/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 7.5
- Created
- 27 Oct 2026, 10:48 PM
- Tags
- Audience
- developersvibe_coderssaas_startup_founders
What happened
CISA confirmed that hackers are actively exploiting two critical PHP vulnerabilities, dubbed PHP2Shell, and ordered U.S. civilian federal agencies to patch within three days. Patches shipped less than a week earlier; PHP is reportedly used by roughly 70% of web-facing servers, and the bugs sat unpatched for about two years after being found because exploitation was deemed impractical — until researchers at security firm Calif built a working exploit with the help of an AI model.
Why it matters
If you ship anything on PHP — WordPress, Laravel, a legacy app on cheap shared hosting — the concrete action is to check the PHP version on every host now and move to a patched release, because the 'not practically exploitable' assumption that justified leaving these bugs open for two years has been disproven by in-the-wild exploitation. Budget hosts that pin old PHP versions are exactly where this bites, and a three-day federal deadline signals how fast mass scanning follows confirmation.
Discussion angle
The exploit was reportedly developed with AI assistance against bugs that humans had written off as impractical for two years — so what's your patching SLA for PHP/WordPress sites, and do you actually know which PHP version your hosting provider is running?