Representative Image
It is said to power roughly 70% of the websites on the internet. Because of the vulnerabilities, the Dutch cybersecurity agency itself went offline, saying it had done so as a precaution.
Disruption was even more widespread in Finland, where state IT services provider Valtori said that the government public network services had been taken offline “as a precautionary measure. ” France’s Interior Ministry said it had placed all of its websites into preventive maintenance. NSA will follow up shortly with more specific guidance,” it said in a post on X.
Several security agencies across the world have sent out an alarming warning that two critical holes have been found in PHP. The critical bugs allow hackers to run code on almost any server running the PHP language. For those unaware, PHP is a server-side programming language widely used for web applications. Reports suggest that the details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches. Public reporting calls the vulnerabilities PHP2Shell, suggesting that attackers could exploit them to obtain shells on vulnerable servers. Following the disclosure, government websites in several parts of Europe, UK and some in the US went offline. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.
Earlier reporting noted: The US National Security Agency urged organisations using the software to install the updates immediately or take vulnerable systems offline. Earlier reporting noted: “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. Earlier reporting noted: Govts in Europe take down sites, US urges fix after AI discovers flaw in programming language PHP Government agencies around Europe and elsewhere shut down websites on Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet.
As all versions may be affected, do not limit discovery to outdated PHP versions; identify PHP installations generally and assess their exposure to CVE-2026-109618 and CVE-2026-109619. Check with your vendor for updated packages. * End-of-life versions (PHP 8.1 and older): Some distributions and LTS vendors provide backported fixes, so contact your vendor or upgrade to a supported version. Because of the severity, the PHP security team has also published minimal source backports for PHP 7.4, 8.0 and 8.1 for organisations that build from source or have no LTS vendor. rpms.remirepo.net users: This volunteer-maintained repository will not have updates on release day.
The US National Security Agency told companies to patch immediately or pull vulnerable systems offline. The flaws “often provide a direct path to the server’s file system or database,” the NSA said in a statement. The EU’s CERT-EU offered similar advice, telling operators to “consider isolating internet-facing applications from public networks until a fix can be applied” where remediation could not happen at once. In a release on its website, it says, “CERT-EU strongly recommends updating all affected PHP installations as soon as possible to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [4].” * Distribution packages: Linux distributions and LTS vendors received the patches in advance.
Attackers could use them to take over web servers without needing a password. The Federal Bureau of Investigation (FBI) urged organizations to take the following steps now: * If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. * Immediately update affected PHP installations following the guidance on PHP webite . Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. * Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. * If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office. Those reports help us identify the actors involved and warn other organizations before they become victims. Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version. Organisations using older versions of PHP are highly encouraged to update to a fully supported version. The NCSC recommends following vendor best practice advice in the mitigation of vulnerabilities. The NCSC highly encourages organisations to follow these priority actions: * Identify systems running PHP across your infrastructure, prioritising internet-facing systems. Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP as a component. Apply relevant updates as they become available. * Update to the latest version of PHP and continue to monitor for future updates. * Apply the additional hardening steps provided by the PHP Team. * If you are unable to update to a version with the security update applied, the PHP Team have provided temporary mitigations. * If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated. * If you are unable to update, or disable, the system immediately then you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker. If you are not confident in your ability to do this yourselves then you can get assistance from an NCSC-assured Cyber Incident Response provider. * Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities. The PHP team urges users to switch to distribution packages or build from source. * Where immediate patching is not feasible, organisations should consider isolating internet-facing resources from public networks until the fix is applied and verified. You use AI every day. Now get your AI Quotient. Take the AIQ test.
Here’s what security agencies across the world are telling companies to do to protect their websites and businesses.