The US National Security Agency (NSA) has issued an urgent warning over two critical security vulnerabilities in PHP, a programming language used by approximately 70% of websites worldwide.
The vulnerabilities could allow hackers to remotely take control of affected web servers, access sensitive information, and compromise databases without needing login credentials.
The NSA warned on Wednesday, October 21, that organizations must immediately update their PHP installations. It also recommended taking vulnerable websites offline if security patches cannot be applied promptly.
Millions of Websites at Risk
PHP is widely used to build websites and web applications, including popular content management systems such as WordPress, Drupal, and Joomla.
Security researchers identified two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
The flaws affect how PHP manages memory and handles errors. Under certain conditions, attackers can exploit them to run malicious code on servers without authentication.
According to security company Wiz, the underlying issues have existed in PHP versions dating back to PHP 5.4, released more than a decade ago.
However, not every website using PHP is necessarily vulnerable, as exposure depends on the installed version and server configuration.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
— NSA Cyber (@NSACyber) October 21, 2026
AI Helped Discover the Flaws
Artificial intelligence played a major role in identifying the vulnerabilities.
Cybersecurity company Calif discovered one of the critical flaws using OpenAI’s GPT-5.6 Sol model through the company’s Patch the Planet initiative.
Separately, Google’s Wiz security team used its Wiz Atlas AI agent, Gemini 4 Argon, and GPT-5.6 Sol to identify multiple PHP vulnerabilities.
Both teams worked with PHP developers to investigate the issues, develop security fixes, and test the patches before publicly disclosing their findings.
Other technology companies, including Cloudflare, AWS, Akamai, Microsoft, Automattic, Fastly, and Vercel, also assisted with security preparations.
Security Patches Released
The PHP Foundation released security updates on October 21, 2026, addressing both vulnerabilities.
The patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Website administrators should upgrade to the latest patched release available for their supported PHP version. Older, unsupported installations may require a more extensive upgrade.
The NSA also advised organizations to identify vulnerable systems, strengthen security monitoring, and temporarily disconnect affected services if immediate patching is impossible.
WordPress clarified that the vulnerabilities are not specific to its platform. Website owners must update their PHP installations, often through their hosting providers, to address the underlying security problems.
AI Raises New Security Concerns
OpenAI said researchers identified the vulnerabilities before attackers were known to have exploited them.
However, security experts warned that AI could also make these flaws easier for hackers to exploit.
Wiz explained that AI models can help attackers adapt malicious code to different PHP versions, server configurations, and memory layouts, reducing the technical expertise previously required.
Although researchers had not confirmed widespread exploitation at the time of disclosure, technical details and early proof-of-concept attacks had begun circulating publicly.
Security agencies are therefore urging website operators to apply the available patches immediately to prevent potential attacks.
The post NSA Tells Website Owners to Update Immediately or Shut Down Their Sites appeared first on ProPakistani.