NSA, FBI and CISA Tell Organizations to Patch Two Critical PHP Flaws or Go Offline

The National Security Agency told every organization running PHP on Wednesday, Oct. 21, to install an emergency update or take its systems offline until it can. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) followed with their own urgent warnings.

The NSA's cyber division said on X that the two critical vulnerabilities "often provide a direct path to the server's file system or database." If an immediate update is not feasible, the agency said, organizations should pull the system offline until it is fully mitigated.

PHP runs on roughly 70% of websites whose server-side language can be identified, according to web tracker W3Techs. WordPress, Drupal, Joomla and Wikipedia's MediaWiki all rely on it.

What the flaws allow

The bugs are collectively called "php2shell." They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP project rated both 9.2 out of 10 on the CVSS v4 scale.

An attacker can run commands on a vulnerable server with a single crafted web request and no login. From there, the attacker can steal data, alter a site's contents or take control of the machine.

One flaw triggers when PHP runs out of memory partway through a request and its cleanup code treats the half-built request data as valid. The same bug can leak chunks of server memory, which can include passwords and API keys. The second lets PHP keep pointing at memory it already freed after a fatal error.

The flaw sits in PHP itself, not in any one website's code. An organization could have locked down its own software and still be exposed. Researchers say vulnerable versions go back to PHP 5.4.

PHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. "If you run PHP, it is imperative that you update now," the PHP Foundation said in a blog post.

Sites go dark in Europe

Government sites went down before the patch landed. In France, local government sites, including the Paris Police Prefecture, have been inaccessible since Wednesday afternoon at the request of the national cybersecurity agency, the Interior Ministry said, citing detection of "a critical security vulnerability."

In the Netherlands, the national digital identity service DigiD, the House of Representatives website and the national cybersecurity center's site went offline as a precaution, according to Dutch broadcaster NOS. Belgium's foreign ministry temporarily pulled its websites. It said on X that the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites.

The flaws were reported privately in August, and the fix was supposed to ship quietly on a coordinated schedule. Details leaked online Tuesday, a day before the planned release, according to AFP, which set off the rush to disable sites.

Who found it

Security firm Calif and OpenAI each flagged the flaws independently on the same day in August. Google-owned Wiz later reported further ways to exploit them and said it demonstrated successful attacks against WordPress, Drupal and Joomla installations.

OpenAI President Greg Brockman said researchers working with an OpenAI initiative used the company's GPT-5.6 Sol model to find a version of the bug in August. He said the flaw has been in the code for 14 years and that a limited version was found in 2024 but not deemed significant.

A separate account differs on the history. SecurityWeek reported that a memory-handling weakness was raised in 2020 and again in a 2024 audit, and was left alone both times because no one could prove an attacker could use it.

"Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory," Brockman wrote on X. Wiz researchers wrote that the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in malware history."

OpenAI also released a PHP version checker inside its Codex system. It said it engaged the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA so guidance would reach critical infrastructure operators.

Is anyone exploiting it yet?

The answer depends on who is asked. CISA said in a blog post that it had not observed exploitation as of publication, though the flaws "pose a risk to organizations if left unpatched."

Other security firms say otherwise. Sansec reported confirmed attacks against Magento and ten other PHP applications, according to Help Net Security. The State of AI publication reported that Cloudflare saw attacks before the fix shipped.

Trey Darley, founder of the standards consultancy Proper Tools, told Nextgov/FCW he expects "a great deal of opportunistic exploitation: attackers don't need to know what's vulnerable before they start knocking on doors." He added that "defenders can't reliably count what they need to patch and protect."

The scale of the cleanup

Palo Alto Networks' Unit 42 said its monitoring identified more than 22.6 million internet-exposed instances potentially vulnerable.

A Nextgov/FCW analysis using the Shodan search engine found roughly 900 results tied to U.S. federal, state and local government websites showing signs of PHP use. Many listed older versions. Nextgov said it is unclear whether those records reflect what is running now, since Shodan may not have captured recent updates.

The FBI asked users to monitor web services for suspicious activity and report "signs of compromise" to a local field office or the Internet Crime Complaint Center. The NSA's advisory, which does not mention AI, promised more specific guidance.

The open question is how fast operators actually patch. Millions of exposed servers now have a public fix, and the same AI tools that found the bugs are available to anyone hunting for unpatched machines.