The Cybersecurity and Infrastructure Security Agency is urging organizations to immediately patch two critical vulnerabilities found in a programming language used by many websites.
According to a CISA alert, organizations should identify and inventory systems running any version of PHP, then apply a patch immediately, prioritizing internet-facing systems. Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
The PHP vulnerabilities were found using artificial intelligence. CISA said that while it has not observed any exploitation of the vulnerabilities, they pose a risk to organizations if left unpatched.









