The Federal Bureau of Investigation has warned organisations of two critical vulnerabilities in PHP, a programming language widely used to power websites and web applications, which could allow hackers to remotely execute malicious code and compromise sensitive data and computer networks.
The FBI Cyber Division, in a statement released on Thursday, identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619.
It urged organisations to update affected PHP installations immediately and take systems offline if they cannot apply the necessary fixes.
The vulnerabilities could expose affected systems to cyberattacks, potentially putting sensitive information and networks at risk.
The agency advised organisations to follow the update guidance published on PHP’s official website and identify all systems running the programming language, particularly those accessible through the internet and vendor products that include PHP.
The statement read, “Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.”
It added that organisations unable to update their systems immediately should take them offline until the vulnerabilities had been fully addressed.
The FBI also urged organisations to monitor their web servers for suspicious activities that could indicate attempts to exploit the flaws.
It specifically warned against unusual PHP processes launching command shells or downloading files, recommending that organisations establish appropriate monitoring systems to detect potential attacks.
The statement read, “Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.”
The agency further advised organisations that discover signs of a breach to isolate affected systems and preserve relevant logs for investigation.
It urged victims to report incidents to their local FBI field offices or through the Internet Crime Complaint Center at ic3.gov.
The statement read, “If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov.”
It added that such reports would help investigators identify the perpetrators and alert other organisations to potential threats.
“Those reports help us identify the actors involved and warn other organizations before they become victims,” the statement added.
The FBI directed organisations seeking further information to PHP’s official security announcement, CERT-EU Security Advisory 2026-018 and the United States Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue.