FBI warns of critical PHP core flaws enabling remote code execution
The FBI's Internet Crime Complaint Center has issued a public service announcement reiterating warnings about two PHP vulnerabilities that allow remote code execution. The alert gives organizations concrete triage steps, from patching to monitoring to incident reporting, and should be read by anyone running internet-facing PHP infrastructure or vendor products that bundle it.
- The PSA follows an initial FBI social media alert issued on October 21 about the same PHP vulnerabilities.
- CVE-2026-109618 and CVE-2026-109619 could allow malicious cyber actors to remotely execute code in PHP core.
- The FBI recommends organizations take systems offline if an immediate update is not feasible.
- Organizations should inventory where PHP runs, prioritizing internet-facing systems and vendor products that bundle PHP.
- CISA published related guidance on October 21, 2026, and CERT-EU issued Security Advisory 2026-018.