US CISA confirms hackers have used a high-risk PHP vulnerability to attack, demanding federal civilian agencies complete system fixes within 3 days