```

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerabilities collectively referred to as "PHP2Shell" to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are being used in real-world attacks and ordering federal agencies to patch by Thursday, according to BleepingComputer.

The listing itself is the more meaningful signal. Inclusion in the KEV catalog does not rest on a theoretical severity score — it requires evidence that a flaw is being exploited in the wild. Once an entry lands in KEV, CISA's binding directives oblige U.S. federal civilian agencies to remediate it within the window the agency specifies. Private-sector defenders have long treated the same list as a practical triage tool for exactly that reason: it ranks work by observed attacker activity rather than by CVSS arithmetic.

What "PHP2Shell" is — and isn't

One point of confusion is worth clearing up before anyone starts searching for a patch. "PHP2Shell" is not itself a CVE identifier, a vendor advisory title, or the name of a single software product. As reported by BleepingComputer, it is the collective label used to describe a set of PHP-related vulnerabilities covered by the CISA addition. The authoritative details — individual CVE IDs, the affected PHP branches, and the exact remediation due date — sit in CISA's own KEV entry, which the agency updates continuously and which is publicly searchable. Administrators should work directly from that entry rather than from the label.

Without a specific CVE in hand, the working assumption should be that internet-facing PHP applications may be affected until the KEV entry says otherwise. Confirming what is actually in production is the first concrete step: run php -v on each web server and compare the result against the affected ranges named in that entry and in PHP's own changelogs.

Why it matters beyond the federal mandate

CISA's deadline binds U.S. federal agencies, but the exploitation evidence applies globally. Any organization running a PHP stack exposed to the internet — content management systems, custom back ends, legacy intranet portals — faces the same attack surface, whether or not a regulator has issued a directive. That includes organizations in Hong Kong operating internet-facing PHP applications, where remediation typically depends on internal patch discipline rather than a statutory clock.

Practical steps for defenders

  1. Check the KEV entry. Pull the CVE IDs, affected versions, and the stated due date from CISA's catalog — it is the authoritative source.
  2. Inventory and verify. Run php -v across web servers and hosting control panels to establish exactly which versions are deployed, flagging anything on end-of-life branches.
  3. Patch or mitigate. Upgrade to a currently supported PHP release where possible. Where an upgrade is blocked by application compatibility, isolate the affected host, restrict inbound traffic, and document the exception with a remediation date.
  4. Harden the perimeter. Apply WAF rules targeting the relevant request patterns, disable unused PHP extensions and dangerous functions, and review file-upload and execution paths.
  5. Audit exposure. Search for forgotten or shadow deployments — staging sites, vendor subdomains, and aging CMS installs are where unsupported PHP versions most often survive.

BleepingComputer's report does not name a threat actor behind the observed attacks. Until CISA's KEV entry or a vendor advisory says otherwise, defenders should treat the exploitation as ongoing and unattributed, and prioritize patching on that basis.

Source: BleepingComputer.

```

據 BleepingComputer 報導，美國網絡安全及基礎設施安全局（CISA）已將統稱為「PHP2Shell」的一組漏洞加入其 Known Exploited Vulnerabilities（KEV）目錄，確認這些漏洞正被用於實際攻擊，並命令聯邦機構須於星期四前完成修補。

列入名單本身才是更具意義的訊號。納入 KEV 目錄並非基於理論性的嚴重程度評分——而是需要漏洞已在野外被利用的證據。一旦條目列入 KEV，CISA 的具約束力指令便要求美國聯邦民事機構在該局指定期限內完成修復。私營機構的防禦人員一直以來都將同一份名單視為實用的分流工具，原因正是如此：它按照已觀察到的攻擊者活動來排定工作優先次序，而非依據 CVSS 數字運算。

「PHP2Shell」是什麼——以及不是什麼

在任何人開始尋找修補程式之前，有一點混淆需要釐清。「PHP2Shell」本身並非 CVE 編號、供應商通告標題，亦不是單一軟件產品的名稱。據 BleepingComputer 報道，它是用來描述 CISA 本次新增所涵蓋的一組 PHP 相關漏洞的統稱標籤。權威詳情——各別 CVE ID、受影響的 PHP 分支，以及確切的修復限期——載於 CISA 自己的 KEV 條目之中，該局持續更新此條目並供公開搜尋。管理員應直接依據該條目行事，而非依據標籤。

在沒有具體 CVE 在手的情況下，工作假設應為：對外連接的 PHP 應用程式可能受影響，直至 KEV 條目另有說明為止。確認實際運行中的版本是第一個具體步驟：在每部網絡伺服器上執行 php -v，並將結果與該條目及 PHP 自身 changelog 所列的受影響範圍作比對。

為何此事超越聯邦指令仍然重要

CISA 的限期只約束美國聯邦機構，但利用漏洞的證據具有全球適用性。任何採用 PHP stack 並暴露於互聯網的機構——內容管理系統、自訂後端、舊式 intranet 入口網站——無論監管機構是否已發出指令，都面對同樣的攻擊面。這包括在香港營運對外連接 PHP 應用程式的機構，其修復工作通常取決於內部 patch 紀律，而非法定時限。

防禦人員的實際步驟

  1. 查閱 KEV 條目。 從 CISA 目錄取得 CVE ID、受影響版本及所列限期——該目錄是權威來源。
  2. 盤點及核實。 在各網絡伺服器及 hosting 控制面板執行 php -v，確定實際部署的版本，並標記任何運行於 end-of-life 分支的系統。
  3. 修補或緩解。 盡可能升級至目前仍受支援的 PHP 版本。若因應用程式兼容性問題而無法升級，則隔離受影響主機、限制入站流量，並以修復日期記錄該例外情況。
  4. 強化防線。 套用針對相關 request pattern 的 WAF 規則，停用未使用的 PHP extension 及危險函數，並檢視檔案上載及執行路徑。
  5. 審計暴露面。 搜尋遭遺忘或影子部署——staging 網站、供應商子網域及老舊 CMS 安裝，往往是不受支援 PHP 版本得以殘存之處。

BleepingComputer 的報導並未指出已觀察到的攻擊背後的 threat actor。在 CISA 的 KEV 條目或供應商通告另有說明之前，防禦人員應將此次利用視為仍在持續且未獲歸因，並據此排定修補優先次序。

來源：BleepingComputer。

新聞來源 / Original News Source