The National Cyber Emergency Response Team (NCERT) has issued a critical cybersecurity warning over two software vulnerabilities that could allow hackers to take control of internet-facing web servers, steal sensitive information, and disrupt online services.
International media recently reported that this threat lets hackers shut down government websites instantly.
The advisory identifies two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP runtime, a technology used to run websites and web applications.
Both vulnerabilities have received a severity score of 9.2 out of 10.
Attackers may be able to exploit vulnerable systems without logging in or obtaining user permission. Security researchers have reportedly demonstrated exploits, while early malicious activity was also reported.
The warning covers government websites, financial institutions, e-commerce platforms, web hosting companies, and other organizations running publicly accessible PHP-based services.
Successful attacks could allow hackers to execute commands on servers, install malicious software, steal login credentials, access databases, change website content, or disrupt online services. Websites running WordPress, Joomla, Drupal, and Magento could also be exposed if their underlying PHP runtime is vulnerable.
National CERT has directed organizations to identify affected PHP versions, prepare and apply official security updates, restrict unnecessary public access, and monitor servers for suspicious activity.
The advisory also warns organizations against relying only on website or plugin updates. Since the vulnerabilities affect PHP itself, administrators may need a separate server-level update through their hosting provider or operating system’s trusted software channels.
Organizations running unsupported PHP versions, including PHP 8.1 and older releases, face additional concerns because official upstream security fixes are not expected for these versions. National CERT recommends migrating to supported versions or isolating systems that cannot be secured.
The agency has also urged organizations to monitor unusual website requests, unexpected server processes, newly created PHP files, and suspicious outgoing network connections that could indicate an attempted or successful attack.
NCERT says organizations should report suspected exploitation or compromised PHP-hosted services through its official incident reporting portal or by contacting the agency.
The advisory urges administrators to prioritize exposed systems, verify that security updates have been applied correctly, and strengthen monitoring to reduce the risk of further attacks.
The post New AI Flaw Lets Hackers Crash Govt Websites Instantly appeared first on ProPakistani.