Skip to content
PHP2Shell Vulnerabilities Exploited Amidst AI-Driven Threats

PHP2Shell Vulnerabilities Exploited Amidst AI-Driven Threats

First seen 30 Oct 2026, 16:53 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 18:47 UTC
  • •PHP2Shell vulnerabilities allow full website takeover and are actively exploited.
  • •CISA has mandated federal agencies to patch systems within three days.
  • •The vulnerabilities were exploited days before patches were available, indicating urgent response needs.

Researchers at Wiz and Calif discovered critical vulnerabilities in PHP, known as PHP2Shell, which allow attackers to take control of websites. CISA confirmed that these vulnerabilities are actively being exploited, prompting federal agencies to patch their systems within three days. PHP powers approximately 70% of the web, raising concerns about widespread impact. The vulnerabilities were exploited four days before patches were released, indicating a shrinking response window for organizations. Experts warn that organizations must be vigilant about existing breaches, as attackers can exploit vulnerabilities before patches are applied. PHP 8.1 and older versions are no longer supported, while PHP 8.2 security support ends on December 31, 2026, affecting many systems. The incident highlights the urgent need for improved patch management and incident response strategies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-30
CISA confirms active exploitation
CISA reported that hackers are actively exploiting critical vulnerabilities in PHP, prompting urgent patching directives.
Ibtimes
Recent
Vulnerabilities discovered
Wiz and Calif identified significant vulnerabilities in PHP, now known as PHP2Shell, enabling potential website takeovers.
Techcrunch

More articles in this cluster (2)

Following this threat?

Track Google in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 2

Common questions

Which PHP versions are affected?
PHP 8.1 and older versions are affected, with PHP 8.2 support ending on December 31, 2026.
What should organizations do immediately?
Organizations should patch their systems within three days as mandated by CISA to mitigate risks.
How are these vulnerabilities being exploited?
Attackers are exploiting these vulnerabilities to take control of websites, with attempts observed before patches were released.