The US National Security Agency (NSA) has urged organisations running PHP to prepare for an emergency update addressing two critical vulnerabilities.
It warned that affected web servers could be taken over by attackers with no prior access. Where an immediate update is not feasible, the agency said, systems should be taken offline until they are fully mitigated.
The advisory, issued on Wednesday, was followed within hours by an alert from the FBI's Cyber Division, which rated the flaws 9.2 on the CVSS scale, at the severe end of the range.
Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay
What Has Been Found
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and sit in PHP core, according to the FBI.
The NSA has nicknamed them "PHP2Shell". Both agencies say they could let malicious actors remotely execute code on a vulnerable server, potentially compromising sensitive data and networks.
The NSA stressed that the weaknesses lie in PHP itself, not in the websites built on it or how they are configured. Any server running an affected version is therefore exploitable.
The agency said cyber actors are likely to weaponise the flaws. It has been prioritising the identification of actors who may try to do so.
ALSO READ | 'PHP2Shell' Alert: Ajay Bagga Flags 'Most Severe' AI-Detected Bug That Puts 70% Of Global Websites At Risk
Why It Matters
PHP is an open-source scripting language that runs on most major operating systems and powers a vast number of websites and web applications. That reach makes the potential exposure wide.
The NSA said the flaws could be used to steal data, disrupt services or move deeper into a network. It added that they require immediate patching across US government departments and agencies.
What Organisations Have Been Told To Do
PHP released an open-source patch on Wednesday. The NSA asked organisations to inventory hardware and software that depend on vulnerable PHP versions, and to apply vendor patches as they appear. Other software vendors that bundle PHP may publish their own fixes.
The FBI advised prioritising internet-facing systems and vendor products that bundle PHP. It also asked organisations to monitor web servers for PHP processes that unexpectedly launch command shells or download files.
ALSO READ | El-Nino Could Be Unprecedented In Strength, Cause Record Pacific Temperature Rise: WMO
Both agencies recommended enhanced logging and replacing end-of-life PHP installations that cannot be patched.
Organisations that find signs of compromise should isolate affected systems, preserve web server and PHP logs, and report to their local FBI field office or ic3.gov.
The FBI pointed to PHP's own announcement, CERT-EU Security Advisory 2026-018 and CISA's Known Exploited Vulnerabilities catalogue for updates.
What Happens Next
Neither agency has said the flaws are being exploited yet. The NSA said it will keep working with CISA and other intelligence community partners, and had earlier promised more specific guidance shortly.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
