US Government Warns Hackers Are Exploiting Critical PHP Flaws Threatening 70% of Websites

TL;DR

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added multiple PHP and PHP-adjacent vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild and triggering federal patch deadlines.
• The most critical flaws allow remote code execution, authentication bypass, and privilege escalation on servers running PHP, with PHP still powering an estimated 70% or more of websites including WordPress, Drupal, and Laravel-based apps.
• Administrators are urged to patch immediately to supported PHP 8.1, 8.2, 8.3 or 8.4 versions, audit internet-facing servers for compromise, and secure related components like PHP-CGI, Roundcube, and hosting panels.

CISA Sounds the Alarm on Active PHP Exploitation

The U.S. cyber agency is warning system administrators to act now: hackers are actively exploiting critical vulnerabilities in PHP, the server-side scripting language that remains the backbone of an estimated 70% to 76% of websites on the internet.

In recent updates to its Known Exploited Vulnerabilities catalog, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed in-the-wild exploitation, meaning the bugs are no longer theoretical — threat actors are using them right now to break into servers. Under federal Binding Operational Directive 22-01, U.S. federal civilian agencies must remediate KEV-listed flaws within 21-30 days, a timeline private companies are strongly advised to follow.

Given PHP's massive footprint powering WordPress, Drupal, Joomla, Magento, Laravel, and millions of custom sites, even a single remote code execution bug can have internet-scale impact.

Which Bugs Are Under Attack

While CISA routinely adds PHP-ecosystem flaws to the KEV, two standouts from 2024-2025 have driven the latest warnings:

The PHP-CGI Argument Injection Vulnerability - CVE-2024-4577

This is the most dangerous and widely exploited issue. Affecting PHP on Windows running in CGI mode, the flaw allows unauthenticated attackers to inject arguments into the PHP-CGI binary due to improper handling of character encoding, particularly with Chinese Traditional, Simplified, and Japanese locales.

An attacker can send a crafted request like `?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input` to achieve remote code execution, effectively taking full control of the web server. It carries a CVSS score of 9.8 out of 10 and has been mass-scanned by botnets, ransomware affiliates, and cryptominers since June 2024 after proof-of-concept exploits were published. CISA added it to the KEV in June 2024.

The 2025 Patch Gap and End-of-Life Danger

Beyond specific CVEs, CISA and partners including the FBI, Japan, and international CERTs have warned throughout 2025 about continued targeting of unpatched and end-of-life PHP versions.

PHP 8.0 reached end-of-life in November 2023, and PHP 8.1 is now in security-only phase, with only PHP 8.2, 8.3 and the new 8.4 branch fully supported as of late 2025 into 2026. Any server still running PHP 7.4, 8.0 or earlier receives no security fixes, leaving newly discovered bugs permanently exploitable.

Attackers are also exploiting the wider PHP supply chain: critical flaws in Roundcube Webmail (CVE-2024-37383, CVE-2024-42008, CVE-2025-49113), Progress Telerik, CrushFTP, and hosting control panels that run on PHP stacks were all added to the KEV in 2025 after confirmed exploitation.

Why PHP Flaws Are So Dangerous

PHP's danger isn't just technical — it's scale.

Remote Code Execution by Default

Many PHP vulnerabilities lead directly to remote code execution without authentication. Because PHP executes on the server to generate HTML, a single malicious HTTP request can trick the interpreter into running operating system commands. That gives attackers a foothold to steal databases, deploy web shells, pivot to internal networks, or install ransomware.

Ubiquity Makes It a Prime Target

With W3Techs and similar trackers consistently showing PHP used by over 70% of websites with known server-side languages, automated scanners can find millions of vulnerable hosts in hours. WordPress alone powers over 40% of all sites, and virtually all WordPress hosting relies on PHP. One exploit kit can therefore be reused against universities, small businesses, e-commerce stores, and government portals alike.

Legacy and Shared Hosting Sprawl

Unlike Chrome or Windows, PHP doesn't auto-update. Millions of shared-hosting accounts, forgotten VPS instances, and on-premise servers run outdated PHP versions set up years ago and never upgraded for fear of breaking compatibility. Threat groups including China-linked APTs, ransomware gangs, and initial access brokers specifically hunt these forgotten servers, using PHP shells as persistent backdoors.

What Administrators Must Patch Immediately

Security officials say there is no reason to delay — patches are available and exploitation is ongoing.

1. Upgrade PHP Now

Move immediately to the latest patched versions of supported branches: PHP 8.1.33+, 8.2.29+, 8.3.24+ or 8.4.x as released in late 2025. On Windows, replace vulnerable CGI binaries urgently or switch from vulnerable `php-cgi.exe` with `mod-php`, FastCGI, or PHP-FPM configurations with proper `RewriteCond %{QUERY_STRING}` mitigations and disabled `register_argc_argv`.

Linux administrators should update via official distro repos, Remi, Ondřej Surý PPA, or Docker images, then restart web servers.

2. Patch the Ecosystem Around PHP

Updating PHP alone isn't enough. Update WordPress core, plugins and themes, Drupal, Laravel, Roundcube to 1.6.11 / 1.5.10+ or 1.6.11+, and any PHP-based admin panels. Remove unused plugins, disable `allow_url_include`, expose no `phpinfo()` pages, and block direct access to `.php` in upload directories.

3. Hunt for Existing Compromise

Because KEV listing means active exploitation, assume internet-facing PHP servers may already be breached. Check for unknown `.php` files, rogue cron jobs, unexpected admin users, large outbound traffic, and CISA's IoCs. Rotate database credentials, API keys, and TLS certificates if compromise is suspected.

Enable WAF rules for CVE-2024-4577, deploy endpoint detection on web servers, and enforce BOD 22-01 deadlines even in the private sector: patch critical internet-facing flaws within days, not months.

The Bottom Line: Don't Wait for a Breach

PHP isn't going away — it still runs the modern web from blogs to banks. That also makes it one of hackers' favorite targets.

The U.S. government's message is clear: these are not hypothetical weaknesses in a security bulletin. They are live weapons being fired at unpatched servers every day. With proof-of-concept code public and mass scanning underway, administrators running any PHP workload should inventory versions today, patch to a supported release tonight, and harden configurations before their site becomes the next KEV statistic.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.