The Federal Bureau of Investigation (FBI) has warned organisations about two critical security vulnerabilities in PHP that could allow attackers to execute malicious code remotely and compromise vulnerable servers.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, affect PHP, a widely used programming language that powers websites, web applications and server-side systems.
The warnings come after the PHP development team released security updates on October 21, 2026, to address both vulnerabilities. The European Union’s cybersecurity agency, CERT-EU, said the flaws could permit remote code execution without authentication, potentially allowing attackers to compromise vulnerable systems.
The FBI’s reported guidance urges organisations to update affected PHP installations immediately and take vulnerable systems offline or isolate them from public networks if they cannot apply the necessary fixes promptly.
Organisations have also been advised to identify every system running PHP, paying particular attention to internet-facing servers and third-party products that include the programming language.
In its reported advisory, the FBI said: “Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.”
The PHP development team has confirmed that the vulnerabilities can enable remote code execution and strongly recommended that users install the security updates rather than rely on temporary workarounds.
The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations using earlier versions in those release branches should upgrade to the corresponding patched versions or move to a supported release. PHP 8.1 and older versions are no longer covered by the project’s current security updates, making migration particularly important.
The FBI also advised organisations to monitor their web servers for suspicious activity that could indicate attempts to exploit the flaws.
Its reported recommendations include watching for unusual PHP processes launching command shells or downloading files, as these activities could indicate that an attacker is attempting to execute commands or introduce malicious software.
Organisations should ensure that their monitoring systems can detect unexpected process activity and investigate suspicious behaviour promptly.
Where signs of a breach are discovered, the reported guidance recommends isolating affected systems, preserving web server and PHP logs, and reporting the incident to the FBI through a local field office or the Internet Crime Complaint Center at ic3.gov.
The information could help investigators identify attackers and alert other organisations to emerging threats.
CERT-EU has separately warned that technical details and early proof-of-concept exploits have become publicly available, increasing the urgency of applying the security updates. It advises organisations to isolate exposed applications where immediate patching is not possible.
The PHP security announcement and CERT-EU advisory provide further technical details for system administrators assessing their exposure.
For organisations running websites or applications built with PHP, the immediate priority is to establish which versions are in use, apply the appropriate security updates and investigate any suspicious activity that may have occurred before patching.
How did this story make you feel?
Join the conversation
Share a thoughtful response. Submissions may be reviewed before appearing.
