CISA Orders Federal Patching as PHP2Shell Exploitation Confirmed

Key points

• CISA confirmed real-world attacks against PHP2Shell.
• Federal agencies were ordered to patch on Thursday.
• PHP2Shell now appears in CISA's exploited-vulnerability catalog.
• No CVE identifier was listed in the available facts.
• Severity is critical; prioritize remediation.

On Thursday, CISA took action against PHP2Shell, a product now tied to confirmed intrusion activity. The agency placed it on its catalog of vulnerabilities known to be exploited in the wild and directed federal agencies to begin remediation. The move signals that the issue is no longer theoretical; attackers are actively using it.

The scope is federal agencies, but the warning has broader relevance. PHP2Shell exploitation can affect any organization running exposed instances, and public-sector networks often share technology patterns across levels of government and education. For K-12 IT teams, the federal mandate is a strong signal to treat PHP2Shell as an urgent exposure, even where no local incident has been reported.

Catalog placement and a patch order mean CISA has confirmed attacks, not just a theoretical weakness. Federal patch mandates create deadlines and reporting expectations; agencies that miss them face increased scrutiny. Because no CVE identifier was included in the facts, defenders should rely on CISA's catalog entry and vendor guidance to identify affected PHP2Shell versions and fixes.

What to watch: whether CISA updates the entry with technical details, whether additional products or agencies are named, and whether attackers shift to mass scanning. Watch for follow-on guidance and any revised patch timeline.

What to do now

1. Treat PHP2Shell as an emergency: inventory all internet-facing systems running it and identify affected versions before end of day.
2. Apply the vendor patch immediately per CISA's order; if no patch is available, isolate the system or apply documented mitigations.
3. Verify remediation with authenticated scans and configuration checks rather than relying on banners or unauthenticated probes.
4. Hunt web server, PHP, process, and file-integrity logs for exploitation attempts and webshell indicators; preserve evidence.
5. Reduce exposure by restricting administrative access, segmenting affected hosts, and applying WAF/IPS virtual patches where possible.
6. Report confirmed compromises to CISA or the relevant ISAC and coordinate with the vendor for incident guidance.
7. Recheck CISA's exploited-vulnerability catalog for updates and adjust patching priorities as new details emerge.

Original source

BleepingComputer