0
Deep & Emerging Tech·October 28, 2026·1 min read

CISA confirms attackers are exploiting both PHP2Shell flaws

Share

PHP2Shell landing in CISA’s KEV list with a 48-hour federal patch deadline is a clear signal that web app plumbing remains a live-fire zone. If you have any PHP exposure—direct or via vendors—treat this as a forced inventory moment and tighten your SLA for patching internet-facing components.