US government says hackers are now exploiting critical PHP web bugs

7:40 AM PDT · October 27, 2026

U.S. cybersecurity agency CISA has confirmed that hackers are now actively exploiting a pair of critical security vulnerabilities in the widely used PHP web software and has ordered civilian federal agencies within the U.S. government to fix their systems within the next three days.

The urgent new warning to patch comes less than a week after the makers of the decades-old PHP web programming language rolled out patches for the two bugs, which allow hackers to remotely break into a vulnerable system over the internet without the need for passwords. The PHP software is reportedly used by some 70% of web-facing servers, putting major websites and applications at risk. The severity of the bugs prompted some governments and big companies to take their sites offline to fix them.

While the bugs are rated critical, meaning they can be highly damaging if exploited,...

Copyright of this story solely belongs to techcrunch.com. To see the full text click HERE