The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given federal civilian agencies across the United States until October 29 to address two critical vulnerabilities in PHP, an open-source scripting language widely used to run websites and web applications, according to a Federal News Network report.

PHP powers roughly 70% of websites worldwide and can also sit behind business-critical applications, administrative interfaces and systems that support essential services. 

According to the report, the National Security Agency has warned that its broad use across major operating systems creates an environment “ripe for exploitation.”

CISA added the vulnerabilities, collectively known as “php2shell,” to its Known Exploited Vulnerabilities catalog on October 26. CISA said they could allow attackers to take control of vulnerable systems without prior access or authorization.

Under a binding operational directive issued earlier this year, CISA reserves its three-day patching deadline for the highest-risk vulnerabilities. It has also urged organizations to identify PHP installations across their environments and take systems offline if they cannot be patched promptly.

Why the Catalog Addition Matters

The vulnerabilities were disclosed last week, but CISA’s addition to the KEV catalog marks a significant escalation: it confirms active exploitation rather than merely scanning activity or proof-of-concept attacks.

The PHP Foundation said it identified the first signs of the underlying problem in 2024 and had been working with security engineers and major technology firms on coordinated disclosure. It added that the bugs were leaked in online forums two days before their planned public release.

Finding Vulnerable Systems Is Becoming a Data Governance Challenge

The incident creates a familiar problem for chief data officers (CDOs): organizations cannot protect data held by systems they cannot identify.

PHP can be embedded in applications, containers, appliances and third-party products. As a result, determining exposure may require more than checking directly managed web servers.

That makes asset inventories, application dependencies and data-system mapping increasingly important. Security teams need to know which systems use vulnerable components, what data those systems handle, whether they are internet-facing and what business processes depend on them.

The incident also shows why vulnerability management must extend beyond patching. 

Cybersecurity experts told the Federal News Network that organizations should review logs and historical activity for signs that attackers exploited the flaws before patches were applied, since attackers may have installed backdoors to regain access.

For data leaders, that means understanding not only where sensitive data resides, but also which software components sit between that data and the users or systems accessing it. Data governance increasingly depends on that visibility as enterprise environments become more interconnected.