The FBI has urged organizations to update PHP installations after two critical vulnerabilities were identified in the widely used programming language. The flaws could allow attackers to run code remotely on affected servers, potentially putting sensitive data and networks at risk.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are known collectively as “PHP2Shell.”
PHP released security updates on October 21. In its message, the FBI said the vulnerabilities “could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.”
The discovery has also drawn attention to AI’s role in cybersecurity research. Google Cloud said Wiz Research, part of a well-established cloud and AI security company, used multiple AI models to identify and help remediate the vulnerabilities.
Wiz said Gemini 4 Argon contributed to vulnerability discovery, exploit development, attack detection and patch validation. Wiz also credited its own Wiz Atlas system and OpenAI’s GPT-5.6 Sol in its research. Separately, OpenAI said cybersecurity startup Calif used GPT-5.6 Sol to identify one flaw, while Wiz independently discovered and reported both.
'Take Systems Offline Until Fully Mitigated'
The FBI said in a post on X on Wednesday that organizations should update affected installations using guidance from PHP.net. It also said that if an immediate update is not feasible, “it is recommended that organizations take the system offline until it can be fully mitigated.”
The FBI advised organizations to inventory where PHP runs, prioritizing systems accessible from the internet and products that bundle PHP. It also urged monitoring for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files.
The agency said organizations that find signs of compromise should isolate affected systems, preserve server and PHP logs, and report the incident to an FBI field office or IC3.
Newsweek has reached out to the FBI, NSA, PHP Foundation, OpenAI, Calif, Wiz and the U.K.’s National Cyber Security Centre for comment.
What Is PHP?
PHP is an open-source programming language that runs on web servers. Websites and applications use it to generate dynamic pages, process requests and interact with databases. It is used in content management systems and other web applications, including WordPress.
Its wide use means that a flaw in PHP can affect many kinds of online services. W3Techs estimated that PHP was used by 69.3 percent of websites whose server-side programming language it could identify as of October 21. That does not mean all of those sites are vulnerable: exposure depends on the version of PHP and how each system is configured.
The U.K.’s National Cyber Security Centre said the vulnerabilities could allow attackers to execute commands on web servers running affected PHP versions. Its guidance said organizations should identify systems running PHP, prioritize those exposed to the internet and monitor them for malicious activity.
...
The flaws could allow attackers to run code remotely on affected servers/Getty
NSA Warns of Potential Access to Files and Databases
The United States National Security Agency Cybersecurity Division said in a post on X on Wednesday: “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.”
“PHP is widely used for web applications,” the NSA said. “These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”
The NSA said PHP released its software patch on October 21 and advised organizations to monitor for vendor updates and assess systems that rely on vulnerable PHP versions.
PHP Updates Address the Vulnerabilities
PHP’s security advisory lists updates for versions 8.2, 8.3, 8.4 and 8.5. The PHP development team said the flaws could allow unauthenticated remote code execution, meaning an attacker would not need to log in first under certain conditions.
The advisory said the vulnerabilities affect PHP installations serving web requests, including systems using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It identified mod_php as the highest-risk configuration because an unauthenticated request could trigger an attack before application code runs.
PHP versions 8.1 and older no longer receive updates from the PHP project, although some Linux distributions and long-term support vendors provide backported fixes. The PHP security advisory lists the patched versions and explains how users of older branches can check for vendor updates.
The FBI’s message directed organizations to PHP’s announcement, CERT-EU Security Advisory 2026-018 and CISA’s Known Exploited Vulnerabilities catalog for further information. The FBI also said reports of compromise could help investigators identify cyber actors and alert other organizations.
Contact Newsweek editor on this story: Edward Pearcey.