Emergency updates have been released for flaws in PHP, software used by millions of websites. Businesses are urged to confirm their systems are protected.
Source: FBI – Federal Bureau of Investigation (via Facebook), and Others
The Federal Bureau of Investigation is urging businesses and website operators to take immediate precautions against two critical security vulnerabilities that could allow hackers to gain unauthorized access to websites and online services.
The vulnerabilities affect PHP, a widely used programming language that operates behind the scenes on websites, including those built with WordPress and other popular content management systems.
Identified as CVE-2026-109618 and CVE-2026-109619, the flaws could allow attackers to execute malicious commands on vulnerable servers without first obtaining a username or password. Successful attacks could expose sensitive information, disrupt business operations or compromise website content.
Both vulnerabilities received severity ratings of 9.2 on a 10-point scale.
Receive the latest stories in your inbox every day — FREE!
The PHP development team released emergency security updates Wednesday, October 21, addressing the vulnerabilities in supported versions of the software.
The European Union Agency for Cybersecurity and other European authorities also issued warnings, urging organizations to identify affected systems and install the updates immediately.
What does this mean for website owners?
PHP is used to process information and perform functions that website visitors rarely see, including retrieving content from databases, managing user accounts and processing online forms.
Because the software operates on web servers, responsibility for installing security updates generally falls to website administrators, developers or hosting providers.
For small businesses using commercial website hosting services, the FBI recommends contacting their provider or technical support personnel to determine whether their systems are affected and whether the necessary updates have been installed.
Businesses operating their own servers should identify all installations of PHP, particularly those accessible from the internet, and apply the security fixes.
The PHP development team has released corrected versions numbered 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older, unsupported versions require particular attention because they do not receive the same official security updates.
The developers warn that temporary protective measures cannot fully substitute for installing the corrected software.
What if a website cannot be updated?
The FBI recommends temporarily taking affected systems offline when immediate security updates are not possible.
Website administrators are also urged to monitor their servers for suspicious activity, including unexpected commands or unauthorized file downloads.
If evidence of an intrusion is discovered, the FBI advises organizations to isolate affected systems, preserve relevant server logs and report the incident to their local FBI field office or the Internet Crime Complaint Center at www.ic3.gov.
Temporarily unavailable websites are not necessarily evidence of a successful cyberattack. Operators may choose to suspend service as a precaution while completing security updates.
What should ordinary internet users do?
The vulnerabilities primarily affect the servers operating websites, rather than the computers or phones used to visit them.
Individual visitors do not need to install PHP updates or change their browser settings in response to the warning.
However, customers should pay attention to security notifications from businesses and organizations that maintain their personal information.
The existence of a vulnerability does not necessarily mean that a website has been compromised or that customer information has been stolen.
For website owners, the immediate priority is confirming that the software has been updated and that their hosting provider or technical support personnel have addressed the vulnerabilities.
Additional information, including the official security updates, is available through the PHP development team’s websiteand CERT-EU Security Advisory 2026-018.
You must be logged in to post a comment.