Ritesh Kumar Yadav
National Repoter
Published: · 283 views
Kathmandu. The US National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) have warned of two critical security vulnerabilities in PHP, a programming language widely used for operating websites and web applications. They stated that cyber attackers could exploit these vulnerabilities to remotely run malicious code on systems and gain access to sensitive data and computer networks.
According to a post published by the FBI's Cyber Division on social media X, these vulnerabilities have been named CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, present in the core structure of PHP, pose a serious risk to the security of websites and web applications.
PHP is widely used in building and operating internet-based websites and applications. Therefore, servers, websites, and networks of organizations using PHP could be at risk of cyber attacks, as warned.
FBI Urges Immediate Update
The FBI has urged organizations to take immediate steps to mitigate the risks. According to them:
– Update Security: Affected PHP systems must be updated immediately according to the security instructions available on the official website.
– Identify PHP Usage: Organizations must identify where PHP is being used in their servers, websites, applications, and other software. Systems directly accessible from the internet should be prioritized.
– Monitor Suspicious Activity: Monitor PHP processes for unexpected command shell execution, file downloads, or other unusual activities.
– Shut Down System if Update Not Possible: If immediate security updates cannot be made, the NSA and FBI recommend keeping affected systems offline until the vulnerabilities are fully resolved.
The NSA has also urged all organizations using PHP to be ready for immediate security updates and stated that more detailed instructions will be issued later.
PHP Security Update Released
PHP's official security team released an update addressing these vulnerabilities on October 21. According to Canada's Cyber Security Center, security improvements are needed in the following versions of PHP:
– Versions older than PHP 8.5.12
– Versions older than PHP 8.4.27
– Versions older than PHP 8.3.36
– Versions older than PHP 8.2.35
Since PHP 8.1 and older versions are no longer officially updated, organizations using them must follow the security instructions of their respective service providers.
According to cybersecurity experts, ignoring these vulnerabilities risks losing control of websites, theft of sensitive data, and unauthorized access to an organization's network. Therefore, organizations using PHP should check the status of their systems and implement available security improvements immediately.
Comments (0)
Log in to leave a comment.
