The FBI has warned organisations about two critical security vulnerabilities in PHP that could allow hackers to remotely execute malicious code on vulnerable servers, potentially exposing sensitive information and putting computer networks at risk.
In a warning issued by its Cyber Division, the US Federal Bureau of Investigation urged organisations to immediately update affected PHP installations, cautioning that systems that cannot be secured promptly should be taken offline until the vulnerabilities are fully addressed.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP, a widely used programming language that powers websites and web applications.
The warning comes as the PHP development team releases emergency security updates to address the vulnerabilities, which can enable attackers to execute code on affected systems without authentication. The official PHP website has urged users to update immediately.
Take systems offline
The FBI has advised organisations unable to install security updates immediately to consider taking vulnerable systems offline until effective protection is in place.
“If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated,” the agency said.
The recommendation underscores the risk of leaving vulnerable servers accessible to potential attackers while security teams work to implement fixes.
Organisations running public-facing websites, business applications and other internet-connected services should prioritise identifying affected systems, particularly those exposed directly to the internet.
The FBI also urged administrators to identify third-party software and vendor products that bundle PHP, warning that vulnerable installations may exist beyond an organisation’s main web server.
Which PHP versions need updating?
The PHP development team released security updates on October 21, 2026, for four supported branches of the programming language.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the official PHP website.
Administrators should check the version running on their servers and consult their hosting providers or software vendors where PHP is managed through a third-party service.
Organisations using older, unsupported PHP versions should not assume they are protected. PHP 8.1 and earlier do not receive fixes through the current release series, making an upgrade to a supported version an important part of remediation.
The FBI directed users to the official PHP website for update guidance and advised organisations to inventory every location where PHP runs across their technology environments.
Suspicious server activity
Installing security updates is only part of the response. The FBI has also called on organisations to monitor their web servers for signs that attackers may be attempting to exploit the vulnerabilities.
The agency specifically warned about PHP processes unexpectedly launching command shells or downloading files, activities that could indicate suspicious behaviour.
“Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation,” the FBI said.
Administrators should investigate unusual processes, review server logs and check for unexpected changes that could indicate unauthorised access.
Organisations should also examine systems that were exposed before the security updates were installed, since patching a vulnerability does not establish whether an attacker had already gained access.
How organisations should report suspected attacks
The FBI urged organisations that discover signs of compromise to isolate affected systems, preserve relevant records and report incidents to authorities.
“If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov,” the agency said.
The FBI added that reports help investigators identify suspected perpetrators and alert other organisations before they become victims.
Organisations can report suspected cybercrime through the FBI’s Internet Crime Complaint Center at ic3.gov.
For website owners, businesses, hosting providers and public institutions, the immediate priority is to establish whether their systems are affected, install the appropriate security updates and investigate any suspicious activity.
