CISA sets Thursday deadline for federal agencies to fix exploited PHP flaws

CISA added two critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog on Monday and set an Oct. 29 remediation deadline for federal civilian agencies. The flaws allow command execution on web servers without credentials; more than 10 million services have been patched since Oct. 21.

• CISA added both PHP2Shell flaws to its KEV catalog on Oct. 26
• Federal agencies must remediate by Oct. 29
• The flaws allow command execution without an account or password
• Censys tracker shows over 10 million services patched since Oct. 21