CISA confirmed active exploitation of two serious PHP security flaws allowing remote system access without passwords.

Following developer patches, U.S. civilian agencies were ordered to fix systems within three days, highlighting ongoing maintenance challenges in widely used web infrastructure.

How the problem was discovered

The two flaws had been in the software for years, but the team that maintains it considered them harmless because they believed they were too difficult to exploit in practice. Earlier this year, however, researchers from security firm Calif managed to find a way to exploit them using an artificial intelligence program. The software's creators released fixes just days before CISA's official warning.

Why problems are dangerous

The vulnerabilities allow unknown parties to remotely access vulnerable systems over the internet, without requiring a password.…