Warning issued over critical exploitation of PHP flaws in thousands of sites worldwide

The US National Security Agency issued an urgent warning two security flaws in the PHP programming language that threaten the security of thousands of websites and applications worldwide and allow attackers to execute commands remotely without needing to log in or hold an account on the server.

The two flaws are tracked as “CVE-2026-109618” and ”CVE-2026-109619“ and carry a high severity rating of 9.2 out of 10. They stem from deep-seated errors in PHP itself rather than in a separate add-on or piece of software.

Given that high severity level, the National Security Agency urged site owners to update immediately and to temporarily disconnect affected systems from the internet if updating them is not possible.

Several security organizations discovered the two flaws, and the necessary patches were issued in coordination with PHP's developers.

Artificial intelligence featured prominently in the discovery and analysis efforts, with researchers using advanced tools from OpenAI and Google to identify exploitation methods and examine the code in depth.

The researchers note that the coding errors behind the two flaws have been present in PHP's code for more than a decade and went undiscovered because they are difficult to exploit.

But modern AI tools helped trace them, exposing the latent danger to the stability of major websites.

What do the two vulnerabilities mean for websites?

These flaws allow commands to be executed directly on the server, letting attackers read sensitive data from application memory — such as passwords or software access keys — access user information, or even take full control of the site or its servers, depending on how well the system is secured and what privileges it grants.

Tests have proven the vulnerabilities can be exploited on popular platforms such as WordPress, Drupal and Joomla, while stressing that the defect lies in PHP itself, not in those systems. Even simple applications running an affected version of PHP remain at risk.

Security updates and required actions

The PHP development team has released a number of updates that fully close both vulnerabilities, covering the following versions:

The team stressed that installing the update is the most important step, while temporary workarounds remain of limited effectiveness.

Older versions such as PHP 8.1 and earlier have stopped receiving official security updates, though some service providers continue to offer partial fixes to certain customers.

Experts advise site administrators to check which version of PHP they are running through their hosting control panel or by contacting their provider, and not to settle for updating their software or plugins alone, because the root of the risk lies in the PHP runtime itself.

For the latest MENA VC news and updates, follow Jawlah on X (Twitter) & .