CISA Flags Two PHP2Shell Bugs as Actively Exploited, Adds Them to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Monday that it has observed active exploitation of two recently disclosed PHP2Shell vulnerabilities, prompting the agency to list the flaws in its Known Exploited Vulnerabilities (KEV) catalog.

Both weaknesses, which affect the PHP2Shell component used to embed a web shell in PHP applications, received a maximum severity rating of 9.2 on the CVSS v3.1 scale. The agency noted that the flaws enable attackers to execute arbitrary code on vulnerable servers, a capability that can lead to full system compromise.

Security researchers disclosed the issues earlier this month, and vendor patches were released shortly thereafter. PHP remains one of the most widely deployed server‑side scripting languages, powering a substantial portion of the web. Consequently, any unpatched instances of the vulnerable code could present an attractive target for cyber‑criminals seeking to harvest data, install ransomware, or use compromised hosts in broader botnet operations.

CISA’s decision to add the bugs to the KEV list underscores the urgency for organizations to verify that the patches have been applied across all environments. The agency’s advisory recommends immediate verification of patch status, deployment of compensating controls such as web‑application firewalls, and continuous monitoring for indicators of compromise that align with known PHP2Shell attack patterns.

Looking ahead, CISA says it will keep the vulnerabilities under close observation and will update its guidance as new intelligence emerges. The move serves as a reminder that timely patch management, combined with robust threat‑hunting practices, remains essential for mitigating the risk posed by high‑severity flaws that are actively weaponized in the wild.