US cybersecurity agency CISA has confirmed that hackers are actively exploiting two serious security vulnerabilities in widely used PHP Web software, and has ordered civilian federal agencies within the US government to fix these systems within the next three days.

Less than a week before the release of this emergency patch warning, the maintainers of the long-existing PHP Web programming language have just released fixes for these two vulnerabilities. These vulnerabilities allow hackers to remotely invade systems with these flaws over the internet without the need for a password. Reports indicate that PHP software is used on approximately 70% of servers targeting Web, putting a large number of websites and applications at risk. The severity of these vulnerabilities has prompted some governments and large companies to take their websites offline for repairs.

Although these vulnerabilities are classified as "severe," meaning that their exploitation could cause significant damage, security researchers say that it is not easy to develop viable attack methods initially – but it is not impossible either. Now that real attacks have been confirmed, there is greater pressure on various organizations to fix their systems as soon as possible in order to prevent malicious intrusions, service disruptions, and data breaches.

In its statement on Monday, CISA did not provide details about who was exploiting these vulnerabilities. However, shortly before the release of that statement, security researchers indicated that they had found evidence that PHP vulnerabilities were being exploited.

These vulnerabilities, referred to as PHP2Shell, exploit defects in the software that have not been discovered for many years. They were first identified two years ago, but the non-profit foundation responsible for maintaining the software stated at that time that hackers did not have any practical methods to exploit these vulnerabilities, so they were not patched. It was not until earlier this year that researchers from the security research company Calif found a way to exploit these long-latent vulnerabilities with the help of a AI model.

The two vulnerabilities in PHP are just a part of the countless others that have not yet been discovered or have been put on hold for many years due to lower priorities. With the improvement in the ability of the AI model to detect and exploit vulnerabilities, including by combining multiple defects, these vulnerabilities now also pose risks.

PHP is one of many outdated Web technologies that support the operation of the internet and modern technology. However, for many years, there has been a lack of resources and funding. This has made it difficult for open-source projects like PHP to afford security audits, which could have potentially identified vulnerabilities earlier.