Critical PHP flaws now exploited in attacks, CISA warns
The US cybersecurity agency CISA confirmed on October 26 that two critical PHP vulnerabilities, known as PHP2Shell, are being exploited in real attacks. The bugs let attackers take over servers remotely without a password. Federal agencies were given three days to patch. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and anyone running PHP sites should update now.
Read the original reporting
- BleepingComputer (bleepingcomputer.com)
- The Hacker News (thehackernews.com)
This summary is written in our own words with the help of AI from the sources above. Please read the original reports for full detail. Spotted a mistake? Write to [email protected].