CERT-In and NSA Issue Urgent Warning Over Critical PHP Flaws Affecting Web Servers
What Happened
India's CERT-In and the US National Security Agency (NSA) have warned organizations about two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that could enable unauthenticated remote code execution on affected servers. CERT-In rated the risk as critical and warned of possible system compromise, while the NSA advised organizations to patch affected systems immediately or take them offline if updates cannot be applied. Security fixes have been released in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Key Takeaways
The vulnerabilities affect software that powers a large share of the world's websites. Cybersecurity agencies are urging rapid patching because successful exploitation could allow attackers to execute malicious code, access sensitive data and potentially take control of vulnerable servers.