FBI warns of flaws exposing websites to hackers

The Federal Bureau of Investigation (FBI) has issued an alert regarding two critical vulnerabilities in PHP, a programming language extensively used for creating websites and web applications. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, could potentially enable hackers to remotely execute malicious code, compromise sensitive data, and infiltrate computer networks.

The FBI Cyber Division warned organizations to update their PHP installations immediately or take their systems offline until the vulnerabilities are resolved. The agency recommended following PHP's official website guidance for updates and identifying all systems running PHP, especially those accessible via the internet and vendor products that incorporate PHP.

If immediate updates are not possible, organizations should isolate their systems and monitor for suspicious activities, such as PHP processes launching command shells or downloading files. The FBI advised organizations to preserve relevant logs and report any incidents to their local FBI field offices or the Internet Crime Complaint Center (ic3.gov) to aid in investigations and threat warnings.