NSA Warns Websites Running Vulnerable PHP Versions to Apply Security Patches Immediately

The United States National Security Agency (NSA) has issued an urgent cybersecurity warning to organisations operating websites and online services powered by vulnerable versions of PHP, a programming language widely used to build and manage websites. The advisory, published on October 21, 2026, concerns two critical vulnerabilities collectively known as PHP2Shell, which could allow attackers to execute malicious code on affected servers without authentication. Depending on the system, successful exploitation could enable criminals to access sensitive information, modify website content, disrupt online services or move deeper into an organisation’s network. The vulnerabilities are particularly concerning because PHP is used across a substantial portion of the internet, including websites built with popular content management systems. The NSA has warned organisations to prioritise security updates and consider taking vulnerable internet-facing systems offline if they cannot be protected immediately.

The security issue involves two flaws in PHP’s underlying runtime rather than a vulnerability limited to one particular website or application. According to the European Union’s cybersecurity response team, CERT-EU, the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each has a reported severity score of 9.2 out of 10. One flaw involves improper memory handling when PHP encounters an out-of-memory condition, while the other involves outdated internal state that can remain accessible after the associated memory has been released. Under certain conditions, these weaknesses can create opportunities for attackers to execute code remotely without first logging into the affected system. The PHP development team released security fixes on October 21 for PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations using older versions must check whether their software provider offers an appropriate security fix or whether an upgrade is required.

The warning has triggered a coordinated response among cybersecurity agencies and technology companies because PHP supports a large number of public-facing services. According to reporting by the Associated Press, authorities and organisations in several countries have been working to patch affected systems, with some websites temporarily disrupted while security updates are applied and tested. Government services and businesses may face additional challenges where websites rely on outdated software, third-party hosting providers or applications that bundle PHP internally. The United Kingdom’s National Cyber Security Centre has advised organisations to identify PHP installations across their infrastructure, prioritise internet-facing systems, monitor for suspicious activity and apply vendor updates as soon as possible. Administrators are also being encouraged to check software appliances and other services that may include PHP even when the organisation does not manage the underlying installation directly.

Artificial intelligence played a significant role in identifying the vulnerabilities, highlighting both the defensive benefits and the potential dangers of increasingly capable AI systems. Security researchers working with OpenAI reportedly used AI-assisted analysis to identify one of the flaws, while researchers at Wiz independently identified another using AI-powered security tools. The researchers coordinated with the PHP project and other organisations to help validate the vulnerabilities and prepare fixes before public disclosure. However, cybersecurity specialists warn that AI can also help malicious actors understand vulnerabilities and adapt exploitation techniques to different software versions and server configurations. Once technical details and proof-of-concept research become publicly available, organisations that delay patching may face increased exposure to automated attacks. The episode demonstrates how AI is changing cybersecurity by helping defenders discover weaknesses while potentially lowering the technical barriers that attackers face when attempting to exploit them.

The NSA has advised organisations to inventory their systems, install the appropriate security updates, strengthen monitoring and replace unsupported PHP services that cannot be adequately protected. Where an internet-facing system cannot be patched promptly, temporarily disconnecting it from public networks may be necessary until the risk is addressed. Organisations should also investigate suspicious activity because installing a patch does not automatically remove malicious software or reverse damage that may have occurred before the update. Website owners who use managed hosting services or platforms such as WordPress should contact their hosting providers to confirm that the underlying PHP environment has been secured. Ordinary internet users do not need to update their phones or computers simply because they visit a PHP-powered website; the primary risk concerns the vulnerable servers delivering the services. As security teams work to address the issue, the priority is to close exposed vulnerabilities, investigate possible compromises and prevent attackers from taking advantage of unpatched systems.