CISA orders urgent PHP patch as hackers exploit critical flaws

The PHP software powers approximately 70% of web-facing servers, creating an expansive attack surface for potential data breaches and service disruptions. While these vulnerabilities remained dormant for years, researchers at Calif recently demonstrated how to weaponize the flaws using AI models. This discovery dismantled the previous assumption that the issues were impractical to exploit, turning long-ignored code defects into immediate security liabilities.

Following the release of official patches last week, the emergence of active exploitation in the wild has intensified the pressure on administrators. Many organizations have already taken websites offline to mitigate risk, reflecting the severity of the threat. The incident highlights a broader systemic issue: aging, essential open-source technologies often suffer from chronic underfunding, leaving them vulnerable to sophisticated attacks that leverage modern AI to uncover and chain long-standing defects.