CISA Designates PHP2Shell Vulnerabilities as Actively Exploited, Sets Federal Fix Deadline

On Tuesday, the Cybersecurity and Infrastructure Security Agency (CISA) reported that the PHP2Shell web‑shell flaws are now listed among its actively exploited security vulnerabilities, and it has mandated that every federal agency implement remediation actions no later than Thursday.

The PHP2Shell script is a hostile payload that attackers can upload to vulnerable PHP‑based sites, giving them the power to run arbitrary commands on the host server. Researchers have been monitoring this tool since early 2023, highlighting its straightforward deployment and its ability to evade simple input‑validation mechanisms.

The flaws, cataloged under multiple CVE identifiers, affect a variety of older PHP releases that still power numerous legacy government portals and internal applications. An exploitation chain typically starts with an adversary finding an unprotected file‑upload point, planting the PHP2Shell code, and then leveraging it to steal data, alter settings, or maintain persistent footholds.

For federal information systems, the danger escalates because a compromised server can become a springboard for wider network penetration, risking exposure of sensitive citizen information or interruption of essential services. Historical web‑shell incidents have shown how rapidly attackers can pivot once a single host is taken over.

In reaction, CISA has inserted the PHP2Shell weaknesses into its Known Exploited Vulnerabilities (KEV) list, a roster that activates mandatory remediation under current federal cybersecurity mandates. Agencies must confirm that patches or mitigations are in place, record their compliance, and convey their status to cybersecurity leadership before the Thursday cut‑off.

Analysts note that the order highlights an increasing focus on swift patching of widely used open‑source components. Public‑sector security teams are expected to perform asset inventories, apply vendor‑released fixes, or deploy compensating measures such as web‑application firewalls when immediate patching is impractical. The directive also serves as a reminder that even ubiquitous scripting languages can turn into attack surfaces if left unpatched, spurring calls for more proactive lifecycle oversight of legacy codebases.