NSA and FBI Warn of Critical PHP Security Vulnerabilities
Summary
The NSA and FBI have warned of two critical PHP vulnerabilities that could let attackers run malicious code remotely and steal sensitive data. Organizations using PHP have been urged to update immediately or take affected systems offline until the flaws are resolved.
Key Points
- The NSA and FBI have warned about two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619.
- Attackers could exploit the flaws to execute malicious code remotely, access sensitive data, and compromise computer networks.
- The FBI has urged organizations to update affected PHP systems immediately, monitor for suspicious activity, or disconnect them from the internet if updates are not possible.
- PHP's security team has released fixes, while older versions such as PHP 8.1 and earlier are no longer officially supported.
