U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

Two critical remote code execution vulnerabilities in PHP, collectively dubbed PHP2Shell, were rapidly weaponized after disclosure, with exploitation surging before many organizations could act. Because these flaws have existed across PHP versions since 5.4 and require no authentication to exploit, unpatched internet-facing servers represent an extremely low-barrier entry point for attackers. A North Korea-linked threat group was observed actively scanning for and targeting vulnerable hosts, demonstrating that nation-state actors move quickly to capitalize on high-severity, widely deployed vulnerabilities. The inclusion in CISA's KEV catalog signals that exploitation is confirmed in the wild, meaning any organization still running a vulnerable PHP version is at immediate, concrete risk. This incident underscores that delayed patching of critical, internet-facing software components can have severe consequences, particularly when attackers can achieve full system compromise without credentials.