- The FBI urged organizations to patch two critical PHP vulnerabilities or take affected systems offline.
- PHP released four security updates on October 21 to fix two critical vulnerabilities.
- The FBI urged server monitoring and preserving logs when signs of compromise appear.
The FBI urged organizations to promptly patch PHP systems following the October 21 release of fixes for two critical vulnerabilities or temporarily take affected systems offline. Its warning also instructed organizations to check for suspicious activity and preserve evidence of possible compromise.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code remotely in PHP’s core, possibly breaching private data and networks.
FBI Urges Immediate Updates and Checks for Compromise
The bureau recommended keeping affected systems offline until the risk could be fully mitigated if an immediate update wasn’t possible. It also asked organizations to identify where PHP runs, prioritizing internet-facing systems and vendor products that include the software.
Alongside those checks, administrators were urged to monitor web servers for PHP processes unexpectedly launching command shells or downloading files. The FBI said appropriate process monitoring could help identify potential exploitation.
If signs of compromise emerged, organizations should isolate affected systems and retain web server and PHP logs. They should then report their findings to a local FBI field office or IC3 to support investigations and warnings to other organizations.
Follow us on X for real-time crypto updates
PHP Publishes Four Security Updates
The PHP development team released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, addressing the two critical vulnerabilities. With the fixes available, it urged users to update affected installations immediately.
That publication followed an advance notice that did not specify which versions were affected or which corrective releases were available. The PHP Group had said it could bring publication forward if vulnerability details became public or exploitation was confirmed.
With patches now available, organizations running affected PHP versions should prioritize updates and check for signs of exploitation. Systems that cannot be patched immediately should remain offline until the risk is mitigated. Reviewing server activity, preserving relevant logs, and reporting suspected compromises can also help limit further damage and support ongoing investigations.
Subscribe to our YouTube channel for the latest crypto news.
Related: OpenAI Helps Uncover Critical PHP Flaws Threatening Millions of Websites
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
