New Delhi: The United States National Security Agency (NSA) has urged organisations running PHP-powered websites and applications to install critical security updates immediately, warning that systems which cannot be patched promptly should be taken offline until the vulnerabilities are addressed.
The urgent warning follows the discovery of two serious security flaws in PHP, a widely used server-side programming language that powers websites, web applications and content management systems. The vulnerabilities could allow attackers to execute malicious code remotely without authentication, potentially giving them access to servers, databases and sensitive information.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, have received a critical severity rating of 9.2 out of 10. Security agencies and technology companies have called for immediate action, particularly on internet-facing systems that may be accessible to attackers.
The NSA issued its advisory on October 21, 2026, stating that organisations should update their PHP installations and assess whether additional protective measures are necessary. If an immediate update is not feasible, it recommends taking the affected system offline until it can be fully secured.
Why the PHP vulnerabilities are serious
PHP, originally known as Personal Home Page and now commonly expanded as PHP: Hypertext Preprocessor, is a server-side scripting language used to create dynamic websites and applications. It helps websites process user requests, interact with databases, manage forms and deliver content.
Because PHP is deployed across a large number of websites, a vulnerability in its core runtime can have consequences beyond a single application. India Today reported that the flaws could potentially affect a significant proportion of websites that rely on PHP.
The two vulnerabilities are associated with memory corruption and the handling of internal application state.
The first flaw, CVE-2026-109618, involves an out-of-memory condition in which PHP may be interrupted while internal request data is only partially initialised. Subsequent cleanup operations can then mishandle invalid data.
The second, CVE-2026-109619, involves stale internal state remaining after the memory supporting it has been freed. Under certain conditions, a later request may use that state before it has been properly reset.
If successfully exploited, these weaknesses could enable remote code execution. In practical terms, an attacker could potentially make a vulnerable server run unauthorised commands, access sensitive information, disrupt services or use the compromised system as a stepping stone into a wider network.
The risk is particularly serious because exploitation may not require an attacker to log in first. The PHP security team has also identified a demonstrated attack against a configuration using Apache’s mod_php, in which a specially crafted request could trigger the vulnerability before application code executes.
NSA recommends immediate patching
The NSA’s advisory urges organisations to install the available security updates and carefully assess systems that cannot be patched immediately.
Taking a vulnerable service offline is a precaution intended to reduce exposure while administrators prepare and test a fix. It is not a declaration that every PHP website has already been compromised, nor does it mean all websites must be permanently shut down.
The agency also recommends monitoring security updates from relevant software vendors, enhancing logging and reviewing systems for suspicious activity. Organisations operating unsupported PHP installations may need to replace end-of-life software with supported versions.
The warning reflects the potential consequences of leaving critical vulnerabilities unaddressed on publicly accessible servers. Even a website that does not directly store financial or personal information could provide an entry point to other systems if its server is compromised.
PHP releases emergency security updates
The PHP development team released security updates on October 21 to address both vulnerabilities. The project has urged users to upgrade immediately, stating that updating is the appropriate way to address the flaws.
The patched versions are:
- PHP 8.5: Upgrade to version 8.5.12 or later.
- PHP 8.4: Upgrade to version 8.4.27 or later.
- PHP 8.3: Upgrade to version 8.3.36 or later.
- PHP 8.2: Upgrade to version 8.2.35 or later.
Users running PHP 8.1 or older should not assume that an ordinary update will be available for their existing branch. These older releases are outside the current support range, and the PHP project has advised users to move to a supported version.
Administrators should check the PHP version actually running on their servers, including installations managed by hosting providers, container platforms and third-party software vendors. Updating an application alone may not fix a vulnerability in the underlying PHP runtime.
The official PHP advisory also states that there are no complete alternative mitigations to updating. Organisations should therefore prioritise applying the appropriate security release rather than relying solely on configuration changes.
India also issues a cybersecurity warning
India’s Computer Emergency Response Team (CERT-In) issued a critical advisory on October 21, warning that the vulnerabilities could allow remote attackers to execute arbitrary code on affected systems.
The Indian agency identified the risk of remote code execution and potential system compromise. Its advisory listed vulnerable versions of PHP 8.2, 8.3, 8.4 and 8.5, and directed users to install the corresponding security updates.
CERT-In also warned of reports indicating large-scale exploitation in the wild, making prompt remediation particularly important. Organisations in India that host websites, operate online services or manage PHP-based applications should review their systems and coordinate with their hosting providers where necessary.
The advisory is relevant to businesses, educational institutions, government departments and other organisations that operate public-facing websites. Smaller website operators should also confirm whether their hosting providers have installed the necessary patches.
AI played a role in discovering the flaws
The vulnerabilities have also drawn attention to the growing role of artificial intelligence in cybersecurity research.
OpenAI said its models helped identify the PHP vulnerabilities. Google Cloud also reported that AI models, including Gemini 4 Argon, contributed to vulnerability discovery and the work involved in validating fixes.
AI-assisted security research can help identify weaknesses in complex software and speed up the development and testing of patches. However, the same capabilities can also help malicious actors analyse software and develop attacks, making rapid remediation increasingly important.
The PHP incident illustrates how AI can contribute to defensive security work while also reinforcing the need for responsible vulnerability disclosure, coordinated responses and timely software updates.
What website owners should do now
Website owners and system administrators should take the following steps to reduce their exposure:
- Check PHP versions: Identify all PHP installations, including those running on hosting platforms, containers and internal servers.
- Install the relevant security update: Upgrade to the patched version appropriate for the PHP branch in use.
- Contact hosting providers: Confirm that the server-side runtime has been updated, especially when the hosting environment is managed by a third party.
- Assess unsupported systems: Plan to migrate older PHP installations to supported releases.
- Review security logs: Look for unusual requests, unexpected processes, unauthorised file changes and other signs of possible compromise.
- Investigate suspected breaches: If compromise is suspected, isolate affected systems as appropriate, preserve evidence and follow incident-response procedures before restoring services.
Organisations should use official advisories from the PHP project and CERT-In as their primary references for technical remediation.
A critical reminder for website operators
The PHP vulnerabilities demonstrate how a weakness in widely deployed infrastructure software can create risks across many sectors. Although the security updates are available, organisations must still identify affected installations and ensure that patches are applied correctly.
The NSA’s advice is clear: patch affected PHP systems as quickly as possible and, where immediate remediation cannot be achieved, take vulnerable systems offline until they can be secured.
For website operators in India and elsewhere, prompt action can help reduce the risk of unauthorised access, data theft and service disruption.