NSA, FBI and CISA warn of two critical PHP security vulnerabilities that could expose web servers to cyberattacks, urging organisations to install patches immediately or take affected systems offline
WASHINGTON: The US National Security Agency (NSA) has issued an urgent cybersecurity warning over two critical vulnerabilities in PHP, a programming language widely used to power websites and online applications.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code remotely without login credentials.
Both flaws carry a critical severity score of 9.2 under the CVSS 4.0 system.
Hackers could access sensitive data
The vulnerabilities, collectively nicknamed PHP2Shell, could allow cybercriminals to compromise web servers, steal sensitive information and disrupt online services.
PHP powers numerous business websites, e-commerce platforms and content management systems, making the warning particularly significant.
The NSA cautioned that attackers could exploit the flaws to access server files and databases.
Security agencies across Europe and Asia have also urged immediate action.
Emergency security updates released
PHP developers released emergency patches on October 21, 2026, addressing both vulnerabilities.
The updated versions include:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The PHP development team warned that updating remains the only reliable protection against the vulnerabilities.
Organisations should prioritise internet-facing systems and coordinate with hosting providers to install the patches.
NSA urges immediate action
The NSA advised organisations unable to install updates immediately to consider taking vulnerable systems offline until they can secure them.
Website administrators should also examine server activity, monitor security alerts and identify outdated PHP installations.
Impact to expect
Businesses could face website disruptions, data breaches and operational losses if they delay security updates.
The warning also highlights cybersecurity risks for government services, financial platforms and online retailers.
Experts expect organisations worldwide to accelerate patching efforts as security teams work to protect vulnerable servers.
