CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA's confirmation that the two newly patched PHP2Shell flaws, both rated 9.2 CVSS and now listed in the Known Exploited Vulnerabilities (KEV) catalog, are being actively exploited marks a critical alert for any site running PHP. For website owners, this means immediate exposure to remote code execution attacks that can hijack servers, inject malicious scripts, or exfiltrate data. Sites still using vulnerable PHP versions (or custom modules that embed the PHP2Shell backdoor) will likely see a surge in bot traffic attempting to weaponize the flaws, potentially inflating analytics and overwhelming security logs. Moreover, compromised sites can become unwitting relay points for AI-driven crawlers that harvest content for training models, skewing llms.txt compliance reporting. **Actionable steps:** 1. **Update llms.txt** to explicitly disallow all user‑agents originating from known exploit kits (e.g., “User‑Agent: PHP2Shell‑Scanner”). 2. Deploy a real‑time bot‑tracking rule in your WAF that flags HTTP requests containing the “/php2shell/” path or suspicious query strings, and automatically block the IP after three hits. 3. Run a rapid inventory scan with a PHP‑specific vulnerability scanner, patch any lingering 7.x/8.x versions, and verify that your server headers no longer expose the PHP version.