US National Security Agency issues stern advisory that all entities using PHP must immediately patch 2 critical vulnerabilities with emergency updates. Here's why this directive is important to heed. Unpatched systems are at immediate risk of full compromise which may leave administrators weighing risk of data theft against downtime. This is a highly important action to take if you are using PHP scripting language for your site.
NSA urges immediate patching of critical PHP vulnerabilities or system shutdown
These vulnerabilities are in the core PHP engine which allow for unauthenticated remote code execution with a single crafted request. According to Wiz researchers who spoke to Help Net Security these are some of the worst bugs found in the platform. If exploited attackers have full access to server files and database without the need to go through any kind of authentication measures.
PHP team has classified both vulnerabilities as 9.2 on CVSS v4.0 scale because of their severity and easy exploitation. These are the exact CVE ID's CVE-2026-109618 and CVE-2026-109619 which will allow system administrators to find right patches in their package managers or update portals.
NSA explicitly states that organizations should disconnect their systems in case they cannot immediately patch the systems. This should buy them time to patch the system while mitigating active exploitation risk. This advisory is directed to the vast majority of websites which still rely on this server-side technology.
PHP team is working on emergency patch to fix these critical vulnerabilities. It is important that organizations act fast to protect their infrastructure before attackers can get access to server through these remote code execution vectors. It is advisable to check your server logs for signs of exploitation during this time-window.
Source: TweakTown
Discussion
0 comments