NSA Tells Website Owners to Update Immediately or Shut Down Their Sites

The US National Security Agency (NSA) has urgently warned website owners to update their PHP installations immediately or risk shutting down their sites. This advisory follows the discovery of two critical vulnerabilities in PHP, a programming language used by around 70% of websites globally. If left unpatched, these flaws could allow hackers to take remote control of servers, access sensitive data, and compromise databases without needing login credentials.

The NSA notified organizations on October 21, 2026, that swift updates are necessary, as vulnerable websites should be taken offline if patching cannot happen promptly.

The vulnerabilities, classified as CVE-2026-109618 and CVE-2026-109619, fall under the collective name PHP2Shell. They impact how PHP handles memory and errors, enabling attackers to execute malicious code on servers without authentication. PHP, a popular tool for web development, powers many content management systems like WordPress, Drupal, and Joomla. While not all PHP-based sites are necessarily at risk, exposure depends on the specific version and server configuration.

Security researchers from Wiz and Calif used artificial intelligence (AI) to uncover the vulnerabilities. Wiz's Wiz Atlas AI agent, combined with Gemini 4 Argon and GPT-5.6 Sol, identified multiple issues, while Calif utilized OpenAI's GPT-5.6 Sol to uncover one of the flaws. Both teams collaborated with PHP developers to develop and test patches before public disclosure. Other tech giants, such as Cloudflare, AWS, Akamai, Microsoft, Automattic, Fastly, and Vercel, supported these efforts.

Security patches were released by the PHP Foundation on October 21, addressing both vulnerabilities. These updates include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Website administrators should upgrade to the latest patched version suited for their supported PHP version. For older, unsupported installations, a more significant upgrade may be required. The NSA also recommended identifying vulnerable systems, enhancing security monitoring, and temporarily disconnecting affected services if immediate patching is impossible.

WordPress clarified that the vulnerabilities are not unique to its platform, advising site owners to update their PHP installations, typically through their hosting providers, to mitigate the risks. AI experts at OpenAI noted that the vulnerabilities were identified before any known attacks. However, they cautioned that AI could potentially make these flaws more exploitable for malicious actors by enabling the adaptation of malicious code across different PHP versions, configurations, and memory layouts.

While no widespread exploitation had been confirmed at the time of disclosure, early proof-of-concept attacks were already circulating online. Consequently, security agencies have urged website operators to apply the available patches immediately to prevent potential attacks.