CISA Warns Federal Agencies to Patch Actively Exploited PHP Flaw

Key points

• CISA issued an alert about active attacks against PHP.
• The issue was added to the KEV catalog.
• Federal agencies must apply updates within a days-long window.
• No CVE identifier was included in the initial facts.

The Cybersecurity and Infrastructure Security Agency has issued an alert about ongoing attack attempts targeting PHP, the widely used server-side scripting language. The agency also placed the issue on its Known Exploited Vulnerabilities catalog, a move that signals confirmed real-world exploitation rather than theoretical risk.

Under the accompanying directive, US federal civilian departments and agencies must apply vendor updates within a compressed window measured in days. That requirement applies across affected PHP deployments in government environments, raising urgency for teams that have not yet scheduled maintenance.

PHP powers a large share of web applications and content management systems, including many public-facing services. Even a short exposure window can be enough for attackers to probe and compromise unpatched hosts, especially where internet-facing applications run outdated PHP runtimes.

The KEV addition matters beyond the federal scope. State, local, and education organizations often follow CISA's catalog as a prioritization signal. For K-12 IT teams in New Brunswick and elsewhere, the alert is a reminder to inventory PHP versions, confirm vendor support, and close gaps in patch management.

What to watch: CISA may update the entry with additional technical details or revised deadlines. Administrators should monitor vendor advisories, validate that updates are applied to all instances, and review logs for exploitation attempts. Because no CVE was included in the initial facts, teams should rely on official CISA and PHP project guidance for specifics.

What to do now

1. Inventory all PHP instances and versions across web servers and applications, prioritizing internet-facing deployments.
2. Apply the latest PHP security updates from the vendor or your distribution maintainer; if immediate upgrade is not possible, isolate affected services.
3. Treat the CISA KEV entry as an emergency change and schedule patching within the directive's days-long window, documenting any exceptions.
4. Review web and application logs for unusual requests, webshell indicators, or exploitation attempts tied to PHP.
5. Verify backups and incident response contacts, and test restores for critical public-facing systems.
6. Subscribe to CISA and PHP security advisories to catch any later CVE details or additional indicators of compromise.
7. For third-party CMS or vendor-hosted applications, confirm whether they bundle PHP and obtain patched builds.

Original source

The Record