India’s cybersecurity agency CERT-In and the US National Security Agency (NSA) have warned organisations about two critical vulnerabilities in PHP, a programming language widely used to run websites and web applications. The flaws could allow attackers to execute malicious code on vulnerable servers, raising concerns for website owners, hosting providers and businesses.
The warning came after the PHP team released security fixes on October 21, 2026. Cybersecurity agencies have urged organisations to apply the updates promptly and prioritise systems exposed to the internet.
What Are the PHP Vulnerabilities?
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry serious risks because they may allow remote code execution, potentially giving attackers a way to run unauthorised code on affected systems.
PHP is used by websites and online applications to process requests and deliver dynamic content. Because it is widely deployed, vulnerable installations could create security risks across a range of organisations.
Why Are CERT-In and the US NSA Concerned?
CERT-In issued a critical-severity advisory in India, while the NSA advised organisations to prepare for immediate security updates. The US agency also recommended taking vulnerable systems offline if they cannot be patched promptly.
European cybersecurity authorities have issued similar guidance, underscoring the international nature of the warning. Security teams are being asked to identify affected systems and coordinate with hosting providers where necessary.
Which Systems Need Attention?
Organisations running PHP-based websites and applications should check their PHP versions and deployment configurations. The vulnerabilities may affect server setups using Apache with mod_php and PHP-FPM, among other configurations.
The PHP team has released fixes in these versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Older, unsupported PHP branches may require vendor-provided fixes or an upgrade to a supported version.
How Can Website Owners Stay Protected?
The primary recommendation is to install the appropriate security update as soon as possible. Website administrators should identify every PHP installation, including those embedded in third-party software, and confirm that patches have been applied successfully.
If immediate patching is not possible, organisations should consider isolating exposed applications from public networks until the issue is addressed. They should also consult their hosting provider or software vendor for guidance.
Why the Alert Matters
The incident highlights the importance of maintaining website infrastructure, not just securing the visible parts of a website. A vulnerability in a widely used programming language can affect many services at once, including systems whose owners may not realise PHP is running in the background.
For businesses and website operators, prompt patching and regular software audits remain essential to reducing the risk of cyberattacks.