Wire · regulatory
US government says hackers are now exploiting critical PHP web bugs
◆ Sectors
◆ Geography
◆ Source
◆ Verified
Fusion42 · 27 October 2026 · Fusion42 review
The U.S. cybersecurity agency CISA has confirmed active exploitation by hackers of two critical vulnerabilities in PHP web software, widely used on 70% of web-facing servers, and has ordered federal agencies to patch their systems within three days. These bugs, named PHP2Shell, allow remote system access without passwords, with AI playing a role in discovering their exploitability, highlighting risks from under-funded open source software security.
This Wire brief sits within Fusion42's coverage of Enterprise Software, and 38 sources have reported it between 21 Oct 2026 and 27 Oct 2026.
◆ ◆ The Wire takeaway
You face immediate risk if your software relies on PHP or similar open source projects. The U.S. government mandate means patch fast or lose government contracts and risk breaches that could shut down your service.
◆ Coverage
38 sources · first reported 21 Oct 2026 · latest 27 Oct 2026
◆ Related on Wire
◆ Topics