US agencies urge fixes for programming language flaws putting millions of web systems at risk

MalBot · October 21, 2026, 4:20pm

The NSA, FBI and Cybersecurity and Infrastructure Security Agency urged organizations Wednesday to fix <a href=“https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-php-updates/”>two critical flaws</a> in software that powers much of the web, warning that systems should be <a href=“FBI Cyber Division on X: "Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, pote… / X”>taken offline</a> if they cannot be secured promptly.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

The vulnerabilities affect PHP, a programming language that works behind the scenes to run websites, process forms and retrieve information. Hackers could exploit the flaws in that software to run commands on an affected server without logging in, potentially allowing them to steal data, change a website’s contents or take control of it.

The scale of PHP’s use makes the warning highly significant. It runs on roughly 70% of websites whose underlying server-side programming language can be identified, according to<a href=“Usage Statistics and Market Share of PHP for Websites, October 2026”> web technology tracker W3Techs</a>. Popular website-building platforms, including WordPress, Drupal and Joomla, rely on it.

Palo Alto Networks’ Unit 42<a href=“Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619”> said its monitoring identified</a> more than 22.6 million internet-exposed instances potentially vulnerable to the flaws.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the cyberdefense agency said in a <a href=“Critical Vulnerabilities in PHP Require Immediate Patching | CISA”>blog post</a>.

A Nextgov/FCW analysis using Shodan, a search engine that catalogs internet-connected systems, identified roughly 900 results associated with U.S. federal, state and local government websites that showed signs of PHP use. Many listed older versions of the software, though it’s unclear if the records reflect the versions currently running on those systems, as Shodan may not yet have captured recent updates.

Governments in Europe have already been taking some websites offline to <a href=“CERT-EU - Critical Vulnerabilities in PHP”>implement fixes</a>.

“I’d expect a great deal of opportunistic exploitation: attackers don’t need to know what’s vulnerable before they start knocking on doors,” said Trey Darley, the founder of ProperTools, a cybersecurity standards consultancy. “Meanwhile, defenders can’t reliably count what they need to patch and protect.”

“Right now, the priority is protecting the systems people actually have,” he added.

The U.S. government was involved in coordinating the response ahead of disclosure. OpenAI<a href=“https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/”> said it and its partners engaged</a> the White House’s Super Intelligence Force, the Office of the National Cyber Director and Cybersecurity and Infrastructure Security Agency to help security guidance reach organizations responsible for critical infrastructure and other essential services.

The flaws, collectively known as “php2shell,” affect the software beneath websites rather than a single website or application. That means an organization could have carefully secured its own code and still be exposed through the PHP software running it.

Cybersecurity company Wiz said it<a href=“PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog”> demonstrated successful attacks</a> against WordPress, Drupal and Joomla installations. Researchers also showed they could read sensitive information from a server’s working memory, including passwords and access credentials.

PHP’s developers also said all installations handling web requests are at risk. Under certain setups, an attack can take place before the website’s own code even executes.

The discovery adds to evidence that AI is helping researchers find and exploit flaws in widely used software. OpenAI said security firm Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the development and release of fixes.

PHP’s developers<a href=“PHP: News Archive - 2026”> released updates Wednesday</a> for supported versions of the software. They said organizations using Linux distributions or long-term support services should check their vendors for updated packages, including fixes adapted for older versions.

The warnings followed an early leak that accelerated plans to disclose and fix the vulnerabilities. A post on the technology forum Hacker News surfaced Tuesday morning and was subsequently removed, but screenshots spread across social media, according to<a href=“https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities”> cybersecurity firm Huntress</a>. PHP’s developers then announced that fixes would arrive a day ahead of the planned disclosure, leaving website operators little time to prepare for updates.

Editor’s note: This story is breaking and may be updated.

Article Link: US agencies urge fixes for programming language flaws putting millions of web systems at risk - Nextgov/FCW