The U.S. government has confirmed that 2 critical security vulnerabilities in the web development language PHP have been exploited in real cyberattacks. The flaws allow hackers to take over servers remotely without a password, and U.S. federal agencies have been ordered to install urgent security updates.

On Oct. 27 (local time), IT outlet TechCrunch reported that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 2 vulnerabilities known as "PHP2Shell" to its catalog of known exploited vulnerabilities (KEV). It ordered federal civilian agencies to patch affected systems by Oct. 29.

The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. They allow remote execution of malicious code on vulnerable servers without going through authentication procedures. Because PHP is widely used on websites worldwide, broader attacks could lead to major service disruptions or data leaks.

PHP developers released a security update on Oct. 21 that fixes the vulnerabilities. But after real-world attacks were confirmed, responses by governments and companies also accelerated. Some institutions and large companies temporarily shut down websites to apply patches.

The flaws stemmed from a security issue that had not been properly resolved for years. The vulnerabilities were found during a security audit in 2024, but they were not fixed at the time because exploitability had not been demonstrated.

The situation changed this year as AI was used. Researchers at security firm Calyphe succeeded in remote code execution by combining existing flaws with the help of an AI model, and reported it to PHP developers.

Signs of actual remote code execution were also confirmed on an attack-detection server built by a security researcher. CISA did not disclose specific information on the attackers or affected organisations.

The security industry assessed the incident as showing that advances in AI can turn vulnerabilities that were previously difficult to exploit into realistic threats. Security management issues in open-source projects that lack manpower and budgets are also drawing renewed attention.

PHP developers recommended that users immediately update to patched versions including 8.5.12, 8.4.27, 8.3.36 and 8.2.35.