Critical Vulnerability Alert: PHP Core

In a follow on to the FBI's initial social media posting on October 21st regarding the identified PHP vulnerabilities, the FBI is sharing this PSA to continue to warn the public of the criticality and necessity to take steps to protect any affected networks from these known vulnerabilities. PHP is a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately. If you are a business owner or website operator, check whether your systems are affected.

The FBI urges organizations to take the following steps now:

If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or www.ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.