PHP Security Alert: US and Indian Agencies Warn of Critical Vulnerabilities in Websites

US and Indian cybersecurity agencies have issued warnings about two critical vulnerabilities in PHP, a widely used programming language that powers websites and web applications. The flaws could allow attackers to execute malicious code on vulnerable servers, raising concerns for website owners, hosting providers and organisations that rely on PHP-based systems. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, prompted an urgent response from cybersecurity authorities. Following the discovery, the PHP development team released security fixes and advised users to update affected installations as soon as possible. India's Computer Emergency Response Team (CERT-In) issued a critical-severity advisory on October 21, 2026, warning that the vulnerabilities could expose affected systems to remote code execution attacks. The US National Security Agency (NSA) also issued a warning recommending prompt security updates for vulnerable PHP installations. The alerts highlight the importance of keeping the software that runs websites and online services up to date, particularly when vulnerabilities could provide attackers with a way to execute commands on remote systems. ### What Are the PHP Vulnerabilities? PHP is an open-source programming language commonly used to build dynamic websites, web applications and server-side services. It is also a core technology behind widely used platforms such as WordPress and Laravel. Because PHP operates on the server, a serious flaw in its runtime environment can create risks for applications that depend on an affected version. The consequences may extend beyond a single webpage, depending on the server's configuration, permissions and the applications running on it. The two reported vulnerabilities concern different aspects of PHP's internal memory management and request processing. Under certain conditions, these weaknesses could allow an attacker to execute unauthorised code on an affected system. Remote code execution is considered a serious security risk because it can give an attacker a way to run commands without legitimate access. Depending on the privileges available to the vulnerable process, successful exploitation could potentially lead to website tampering, unauthorised access to data or further compromise of the server. However, the existence of a vulnerability does not automatically mean that every PHP website has been compromised. The actual risk depends on the software version, server configuration and whether the system is exposed to the conditions required for exploitation. ### Why Did CERT-In Issue a Warning? CERT-In, India's national agency responsible for responding to cybersecurity incidents, issued its advisory to alert users and administrators to the potential risks associated with the affected PHP versions. The warning urged organisations to review their systems and apply the appropriate security updates. Such advisories are particularly important for businesses operating public-facing websites, online services and applications that process sensitive information. The US NSA also highlighted the need for timely patching. The warnings from the two agencies underline the importance of responding quickly when critical vulnerabilities affect widely deployed software. For website operators, the immediate priority is to determine whether their systems use an affected PHP release and, if so, install the appropriate security fix. ### Which PHP Versions Are Affected? According to the reported security guidance, the vulnerabilities affect specific releases across several PHP branches. Administrators should consult the official CERT-In advisory and PHP security announcements to identify the affected versions and corresponding patched releases. They should not assume that a system is protected simply because it uses a relatively recent PHP version. Website owners using managed hosting should contact their providers to confirm whether the server's PHP runtime has been updated. Those operating their own servers should check the installed version and apply the security update recommended for their release branch. Applications running on unsupported PHP versions may require an upgrade to a supported release, subject to compatibility testing and the provider's recommendations. ### What Should Website Owners Do? Security specialists recommend taking practical steps to reduce exposure and ensure that affected systems are properly updated. **Check the installed PHP version:** Review the hosting control panel, server configuration or deployment environment to determine which PHP release is running. **Apply the official security patches:** Upgrade affected installations to the appropriate fixed release after checking application compatibility and the vendor's guidance. **Contact the hosting provider:** Website owners who do not manage their own servers should ask whether the PHP runtime has been patched and whether any additional action is required. **Review server logs:** Check for unusual requests, unexpected processes, unauthorised file changes or other suspicious activity, particularly if a vulnerable system was exposed to the internet. **Restrict access where necessary:** If a system cannot be patched immediately, follow official mitigation guidance and consider limiting exposure or temporarily isolating the affected service. **Verify the update:** After patching, confirm that the server is running the intended version and that the application continues to operate correctly. Updating a content management system or installing a new theme does not necessarily fix a vulnerability in the underlying PHP runtime. Both the application and its server environment need appropriate security maintenance. ### How AI Is Changing Cybersecurity Research The PHP warning also draws attention to the growing role of artificial intelligence in software security research. AI-assisted tools can help researchers analyse large codebases, identify suspicious programming patterns and investigate possible vulnerabilities. These tools may make it easier to examine complex software, but findings still need to be validated through technical testing and coordinated disclosure. Once a vulnerability has been confirmed, developers must assess its impact, prepare a fix and release an update that addresses the underlying weakness. System administrators then need to install that update and verify that their systems are protected. The process illustrates why cooperation between security researchers, software developers and government agencies is essential. Identifying a flaw is only the first step; effective protection depends on getting reliable fixes to affected users and ensuring that those fixes are installed. ### What the Warning Means for Businesses For businesses that depend on websites, APIs or online services, the PHP vulnerabilities are a reminder that security risks can arise from the software beneath an application, not just from its visible features or plugins. Organisations should maintain an inventory of their server software, track security advisories and establish a process for applying critical updates quickly. Regular backups, access controls, monitoring and incident-response plans can also help reduce the impact of a security incident. Website owners should rely on official security advisories when determining whether their installations are affected and which updates are required. The warnings from CERT-In and the US NSA reinforce a straightforward message: administrators should check their PHP environments, apply the recommended security fixes and investigate suspicious activity where necessary. Prompt maintenance is an important part of protecting websites and the information they handle.