FBI warns of flaws exposing websites to hackers

The Federal Bureau of Investigation has issued a warning regarding two critical security flaws found in PHP, a programming language extensively utilized for creating websites and web applications. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could enable hackers to remotely execute malicious code and gain access to sensitive data and computer networks, posing a significant threat to organisations.

In a statement released on Thursday, the FBI Cyber Division emphasized the urgency for organizations to promptly update their PHP installations and isolate systems that cannot be updated. The statement urged organizations to follow PHP's official website guidance and take systems offline if necessary. The FBI advised organizations to monitor their web servers for any suspicious activities, such as PHP processes unexpectedly launching command shells or downloading files, indicating potential exploitation attempts.

If signs of a breach are detected, organizations should isolate affected systems, preserve relevant logs, and report incidents to their local FBI field office or the Internet Crime Complaint Center at ic3.gov. The FBI emphasized that such reports would aid in identifying perpetrators and alerting other organizations to potential threats.