Ankara:Developers of the widely used PHP programming language have urged users to install security updates immediately after two critical vulnerabilities were found that could allow remote code execution. This development has raised concerns about the security of websites and servers globally.
According to Anadolu Agency – English, the vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 involve memory-handling errors and outdated internal states that can persist between requests. These issues potentially allow attackers to execute malicious code on affected servers. The developers released patched versions of the program and warned that attackers could exploit the flaws without authentication.
The US National Security Agency (NSA) has also asked organizations using PHP to prepare for an immediate update, warning that the vulnerabilities could provide attackers with direct access to server file systems or databases. The NSA emphasized that if an immediate update is not feasible, organizations should take the system offline until it can be fully mitigated. More detailed guidance from the agency is expected to follow.
The FBI Cyber Division has echoed these warnings, urging organizations to immediately update affected PHP installations and inventory systems running PHP, with a focus on internet-facing servers and third-party products that include the programming language. The bureau also recommended monitoring web servers for suspicious activity, such as PHP processes unexpectedly launching command shells or downloading files, to help identify potential exploitation.
OpenAI stated that its models assisted researchers in discovering the flaws through its Patch the Planet initiative, which brought together software maintainers, researchers, and security providers to develop fixes before public disclosure. The company noted that the preparation process took two months due to the complex changes required to the PHP engine.
PHP is used in a substantial share of the internet, with OpenAI estimating that it powers around 70% of websites. The scale of its use means that unpatched systems could create significant opportunities for attackers.