CISA gives federal agencies until Thursday to address exploited PHP flaws
JuSun/Getty Images
ByDavid DiMolfetta,
Cybersecurity Reporter, Nextgov/FCW
October 27, 2026 01:34 PM ET
The agency’s order adds urgency to a worldwide repair effort, though the extent of successful attacks remains unclear.
Federal civilian agencies have until Thursday to address two critical PHP vulnerabilities that CISA has now warned are being exploited by hackers, escalating the government’s response to flaws in software used to operate websites worldwide.
The Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog Monday, setting an Oct. 29 remediation deadline. The designation marks a change from CISA’s initial warning last week, when the agency said it had not observed exploitation. The catalog entries do not identify victims or describe the evidence behind the decision, leaving the scale of successful attacks unclear.
Known collectively as PHP2Shell, the vulnerabilities can allow hackers to run commands on a...
Copyright of this story solely belongs to www.nextgov.com. To see the full text click HERE
