10
Loading video...
By Faye James
US news reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
The FBI has urged organizations to update PHP installations after two critical vulnerabilities were identified in the widely used programming language. The flaws could allow attackers to run code remotely on affected servers, potentially putting sensitive data and networks at risk.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are known collectively as “PHP2Shell.”
PHP released security updates on October 21. In its message, the FBI said the vulnerabilities “could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.”
Read More on News
The discovery has also drawn attention to AI’s role in cybersecurity research. Google Cloud said Wiz Research, part of a well-established cloud and AI security company, used multiple AI models to identify and help remediate the vulnerabilities.
Wiz said Gemini 4 Argon contributed to vulnerability discovery, exploit development, attack detection and patch validation. Wiz also credited its own Wiz Atlas system and OpenAI’s GPT-5.6 Sol in its research. Separately, OpenAI said cybersecurity startup Calif used GPT-5.6 Sol to identify one flaw, while Wiz independently discovered and reported both.
'Take Systems Offline Until Fully Mitigated'
The FBI said in a post on X on Wednesday that organizations should update affected installations using guidance from PHP.net. It also said that if an immediate update is not feasible, “it is recommended that organizations take the system offline until it can be fully mitigated.”
The FBI advised organizations to inventory where PHP runs, prioritizing systems accessible from the internet and products that bundle PHP. It also urged monitoring for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files.
The agency said organizations that find signs of compromise should isolate affected systems, preserve server and PHP logs, and report the incident to an FBI field office or IC3.
Elizabeth Barron, the executive director of the PHP Foundation, which ensures the long-term prosperity of the PHP language, told Newsweek: "Anyone running unsupported versions of PHP is indeed vulnerable, and we recommend upgrading as soon as possible.
"This issue has highlighted how reliant the world is on PHP. It also showed that without The PHP Foundation, critical functions like security and core maintenance rely heavily on volunteers who can contribute only when they have the capacity to do so, which is unsustainable. We have greatly improved our communication and coordination with industry partners and security firms, and we are working to grow our pool of paid contributors to ensure the long-term sustainability of the language, which we can only do with more funding from the community of users."
Newsweek has reached out to the FBI, NSA, OpenAI, Calif, Wiz and the U.K.’s National Cyber Security Centre for comment.
What Is PHP?
PHP is an open-source programming language that runs on web servers. Websites and applications use it to generate dynamic pages, process requests and interact with databases. It is used in content management systems and other web applications, including WordPress.
Its wide use means that a flaw in PHP can affect many kinds of online services. W3Techs estimated that PHP was used by 69.3 percent of websites whose server-side programming language it could identify as of October 21. That does not mean all of those sites are vulnerable: exposure depends on the version of PHP and how each system is configured.
The U.K.’s National Cyber Security Centre said the vulnerabilities could allow attackers to execute commands on web servers running affected PHP versions. Its guidance said organizations should identify systems running PHP, prioritize those exposed to the internet and monitor them for malicious activity.
...
The flaws could allow attackers to run code remotely on affected servers/Getty
NSA Warns of Potential Access to Files and Databases
The United States National Security Agency Cybersecurity Division said in a post on X on Wednesday: “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.”
“PHP is widely used for web applications,” the NSA said. “These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”
The NSA said PHP released its software patch on October 21 and advised organizations to monitor for vendor updates and assess systems that rely on vulnerable PHP versions.
PHP Updates Address the Vulnerabilities
PHP’s security advisory lists updates for versions 8.2, 8.3, 8.4 and 8.5. The PHP development team said the flaws could allow unauthenticated remote code execution, meaning an attacker would not need to log in first under certain conditions.
The advisory said the vulnerabilities affect PHP installations serving web requests, including systems using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It identified mod_php as the highest-risk configuration because an unauthenticated request could trigger an attack before application code runs.
PHP versions 8.1 and older no longer receive updates from the PHP project, although some Linux distributions and long-term support vendors provide backported fixes. The PHP security advisory lists the patched versions and explains how users of older branches can check for vendor updates.
The FBI’s message directed organizations to PHP’s announcement, CERT-EU Security Advisory 2026-018 and CISA’s Known Exploited Vulnerabilities catalog for further information. The FBI also said reports of compromise could help investigators identify cyber actors and alert other organizations.
'AI Is Accelerating the Task of Security Vulnerability Discovery'
"OpenAI invited us to join its Patch the Planet initiative, and PHP stood out as a high-impact target. We started scanning on July 30, and quickly found the vulnerabilities in a few days of work," a Calif spokesperson told Newsweek.
"AI is accelerating the task of security vulnerability discovery and exploitation. It is a super powerful tool and people can use them in different ways. AI-driven attacks will be a major problem in the future.
"Calif recognized the severity of the situation very earlier on. That's why we immediately contacted the PHP Foundation and started the disclosure process. Given the extraordinary coordination efforts across the industry, most large PHP users were notified and had time to fix; therefore, most users should not be too worried. Having said that, there may be many unpatched systems and their users will be affected.
Amazon, Cloudflare and others have both reported exploitation attempts before and after public disclosure."
Contact Newsweek editor on this story: Edward Pearcey.
Update 10/22/26 9.50 a.m. ET: This article was updated with a statement from The PHP Foundation.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines