U.S. cybersecurity agency CISA has confirmed active exploitation of two recently patched PHP2Shell vulnerabilities and added them to its Known Exploited Vulnerabilities (KEV) catalog. The flaws are described as unauthenticated remote code execution issues affecting vulnerable PHP deployments, which means attackers may be able to run malicious code on exposed systems without valid login credentials.

For European businesses, the development matters because PHP remains widely used in websites, e-commerce platforms, content management systems, custom web applications and hosting environments. When a vulnerability moves from a theoretical risk to confirmed exploitation, patching and exposure assessment typically become more urgent.

What happened

According to the source report, CISA added two PHP2Shell flaws to its KEV catalog after confirming they are being actively exploited in the wild. The vulnerabilities were recently patched and were reported as carrying high severity ratings. The source describes them as enabling unauthenticated remote code execution on affected deployments.

CISA's KEV catalog is a public list of vulnerabilities that the agency says have evidence of real-world exploitation. Inclusion does not by itself create legal obligations for most European private-sector organisations, but it is a strong operational signal that attackers are not merely testing the issue in labs.

Why it matters for European businesses

Many European SMEs rely on PHP indirectly, even if they do not manage PHP infrastructure themselves. Business websites, customer portals, online stores, internal tools and agency-built applications often depend on PHP-based stacks. A remotely exploitable flaw at that layer can create risks including website defacement, malware deployment, data theft, account compromise or follow-on attacks inside connected systems.

This is particularly relevant where businesses:

• Run self-hosted PHP applications or legacy web systems
• Use shared or virtual hosting environments
• Depend on custom-built PHP websites maintained by agencies or freelancers
• Operate e-commerce stores connected to payment, CRM or ERP systems
• Have limited internal security monitoring and patch-management capacity

For regulated sectors, the impact may go beyond downtime. A successful compromise could lead to personal data exposure, service disruption, incident response costs and possible notification obligations under applicable cybersecurity or privacy rules, depending on the nature of the breach.

Who may be affected

The most directly affected organisations are those with internet-facing PHP deployments. That can include SMEs, online retailers, SaaS providers, digital agencies, hosting providers and IT teams responsible for web infrastructure.

Companies may also be exposed indirectly if a supplier manages their site or application environment. In practice, that means business owners should not assume they are unaffected simply because their website is maintained by an external developer or hosting partner.

What companies should consider

European businesses do not need to wait for more public reporting before acting. Confirmed active exploitation is usually enough to justify accelerated remediation.

• Identify exposure: Determine whether your websites, applications or hosting environments use affected PHP versions or deployments.
• Apply vendor patches: If patches are available, prioritise them based on internet exposure and business criticality.
• Check managed suppliers: Ask hosting providers, web agencies and software vendors whether their environments have been assessed and updated.
• Review logs and alerts: Look for unusual web-server activity, unexpected processes, new files, privilege changes or outbound traffic that could indicate exploitation.
• Restrict unnecessary exposure: Where immediate patching is difficult, consider temporary mitigation such as limiting public access, segmenting systems and tightening administrative access.
• Prepare incident response: If compromise is suspected, preserve logs, isolate affected systems and assess whether customer or employee data may have been exposed.

Because the source report provides only limited technical detail, companies should rely on official vendor advisories and trusted security guidance for exact remediation steps. For European organisations with limited in-house security capacity, this is the kind of issue that should be escalated quickly to an IT partner or security provider.