New AI Flaw Lets Hackers Crash Govt Websites Instantly

The National Cyber Emergency Response Team (NCERT) has issued a critical cybersecurity warning regarding two software vulnerabilities in the PHP runtime that could enable hackers to seize control of web servers, exfiltrate sensitive data, and cripple online services. Recent international reports indicate these flaws allow hackers to instantly bring down government websites.

The advisory highlights two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both of which have a severity score of 9.2 out of 10. Attackers may exploit these vulnerabilities without authentication. Security researchers have shown proof-of-concept exploits and early malicious activity has been reported. The warning applies to government websites, financial institutions, e-commerce sites, web hosting firms, and any organization operating PHP-based services.

Compromised websites could be manipulated, credentials stolen, databases accessed, content altered, or services disrupted. WordPress, Joomla, Drupal, and Magento sites may be at risk if their PHP runtime is affected. NCERT advises organizations to identify vulnerable PHP versions, apply official security patches, limit public access, and monitor servers for malicious behavior.

The advisory stresses relying on PHP updates, as these vulnerabilities stem from the core product itself. Organizations using unsupported PHP versions, like PHP 8.1 and earlier, must act urgently due to the lack of official fixes. NCERT recommends migrating to supported versions or isolating vulnerable systems. The agency urges reporting any suspected exploitation to its incident reporting portal or directly.

Admins should prioritize exposed systems, confirm patch correctness, and strengthen monitoring to mitigate further threats.