FBI warns businesses to patch or remove vulnerable PHP systems immediately

The FBI has issued an urgent warning about two critical security flaws in PHP, designated CVE-2026-109618 and CVE-2026-109619, which are actively threatening systems worldwide. Attackers can exploit these vulnerabilities to breach systems, jeopardizing sensitive data and core business operations, and security updates are available now. Organizations must immediately inventory where PHP operates, prioritizing internet-facing systems and vendor products that bundle PHP. If patching is not feasible, the FBI strongly recommends taking affected systems offline, while also monitoring web servers for suspicious activity like PHP processes launching command shells or downloading files. In case of compromise, administrators should isolate affected systems, preserve logs, and report incidents to the FBI via ic3.gov. PHP is a widely used server-side scripting language powering major content management systems like WordPress and Drupal, with further guidance available from php.net, CERT-EU, and CISA.