FBI urges businesses to patch or pull offline vulnerable PHP systems immediately 

The Federal Bureau of Investigation (FBI) has issued an urgent warning regarding two critical security flaws—designated as CVE-2026-109618 and CVE-2026-109619 — actively threatening PHP-driven infrastructure worldwide. Attackers can exploit these vulnerabilities to breach systems, putting sensitive data and core business operations in severe jeopardy. 

Security updates are currently available and must be applied immediately. For business owners and website operators, the immediate course of action involves coordinating with IT support teams, website developers, or hosting providers to identify vulnerable systems and apply necessary patches. 

If an immediate update is not feasible, the FBI strongly recommends taking the affected system offline until full mitigation can be achieved. Organizations must inventory where PHP operates within their environment, prioritising internet-facing systems and vendor products that bundle PHP. 

Operators are also urged to actively monitor web servers for suspicious activity, such as PHP processes unexpectedly launching command shells or downloading files, while ensuring appropriate process-monitoring capabilities are in place.

In the event of a compromise, administrators must isolate affected systems, preserve web server and PHP logs, and report the incident to a local FBI field office or via ic3.gov to help authorities identify threat actors and protect other organizations. 

For ongoing updates and technical guidance, reference PHP’s official announcements on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog. 

What is PHP

PHP (which stands for PHP: Hypertext Preprocessor) is a widely used open-source scripting language designed specifically for web development. It runs on a web server to generate dynamic web pages before they are sent to a user's browser. 

Key characteristics of PHP include: 

• Server-side execution: Unlike client-side languages like JavaScript, PHP code is processed entirely on the server, hiding the underlying logic and source code from the end user. 
• Database integration: PHP connects seamlessly with popular database management systems like MySQL, PostgreSQL, and SQLite, making it a core component for content-driven platforms. 
• Foundational web tech: It serves as the backbone for major content management systems — including WordPress, Drupal, and Magento — and powers a large portion of websites and online services globally.