US warns hackers are actively exploiting critical PHP flaws

US cybersecurity agency CISA says hackers are actively exploiting two critical vulnerabilities in PHP and has ordered federal civilian agencies to patch within three days. The bugs, patched less than a week ago, let attackers break into systems remotely without passwords. PHP reportedly runs on about 70% of web-facing servers, and some organisations took sites offline to fix them.