CISA also updated its PHP alert covering critical PHP vulnerabilities.
The agency says these vulnerability types are frequently used by malicious cyber actors. Under Binding Operational Directive 26-04, US Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets when exploitation grants total control of the asset. The directive also sets expectations for checking whether a system was compromised before a patch was applied.
The directive applies to federal civilian executive agencies, but CISA encourages other organizations to use risk-based vulnerability management and prioritize KEV entries. The alert does not identify affected PHP versions, available patches, specific products, observed attackers, or affected organizations.