CISA urges immediate patching of PHP2Shell flaws in PHP, used by 69.3% of websites
US agency CISA told organisations to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and to take unpatchable systems offline. Cloudflare reported early attack attempts; CISA said it had not observed exploitation.