LUCAMEA vulnerability in PHP2Shell is being actively exploited in the wild, with confirmed attacks verified over the weekend. The US cyber agency CISA has added it to its official catalogue of known exploited vulnerabilities, which is a reliable signal that attacks are spreading beyond early targets.
What this means for your business
If your business runs any web applications or servers that use PHP2Shell, you'll want to check whether it's present and get it patched as a priority. Active exploitation means attackers are already using working tools to target this, so it's not theoretical. Speak to your IT team or provider this week rather than leaving it for the next maintenance window.