Although PHP security patches must be implemented by developers and website operators, experts say consumers can still strengthen their defenses by keeping their own devices and software fully updated.
The widely used scripting language that supports websites around the globe is the subject of a new warning from several national agencies, including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency.
PHP, or hypertext preprocessor, is largely invisible to most internet users. Yet the programming language helps power roughly 70% of websites worldwide, according to some estimates.
As of this week, organizations that had not yet installed the necessary fixes were advised to take their websites offline until the patches could be applied. Government websites across Europe were also taken down earlier in the week to allow operators to make the required security changes.
“Two critical vulnerabilities have been identified in PHP, a widely-used programming language that powers websites and web applications,” the FBI said in social media posts shared Wednesday. “These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.”
Artificial intelligence helped identify two separate flaws in PHP, creating potential risks for countless websites and the pages people visit every day. But experts warned this week that the same technology could also be used to exploit the vulnerabilities.
Guannan Liu, an assistant professor of computer science at Colorado School of Mines who holds a Ph.D. in computer engineering, said most consumers are not exposed to the same level of risk as website operators and organizations running web servers. Even so, he urged people to remain alert for suspicious activity.
“It lives on the server side,” Liu said of PHP. “It basically allows attackers to run out of memories on those servers.”
“Attackers can inject their own code, and the PHP — when they run out of memory — they jump to the attacker’s code,” he said. “From there, the attacker’s code can run secretly on the server and do a lot of bad things. The attackers can make the server run whatever they want.”
Reports suggest the vulnerabilities were discovered years ago but only recently recognized as immediate threats to servers worldwide. Systems that remain unpatched could be especially vulnerable to attackers seeking to access or compromise sensitive information.
EXPLORE MORE: Firehouse Subs Co-Founder Chris Sorensen Dies After Building Beloved American Sandwich Chain With His Brother
If exploited, the flaws could potentially give attackers remote access to banking, airline, health care and government websites without requiring the login credentials normally needed by users. An attacker could execute commands on a server without a username, password, two-factor authentication or another standard user-facing security measure.
PHP is behind-the-scenes technology built on free, open-source code and is widely integrated into server systems. When someone visits a website, a server running PHP uses the code to help assemble the requested page before sending the completed content to the user’s browser.
At the time of publication, many websites had either applied the available patches or been deliberately taken offline while operators worked to resolve the problem.
“If you want to go to some certain website to get to certain services, and you find out that their service is down and you can’t get those services, it’s because maybe they’re afraid of PHP vulnerabilities,” Liu said. “They’ve turned their service down intentionally to avoid further losses or risks.”
For most consumers, Liu said, there is little immediate action to take beyond allowing important software updates to install on phones, laptops and desktop computers. Using current software helps ensure that a device’s security protections are also up to date.
“You don’t know if there are any security patches or really important fixes,” Liu said. “So, to protect yourself, to protect your data, do keep all of your software updated and use the current version.”
Consumers should also watch for notices from the services and providers they use, particularly if those organizations report a possible data breach, he said.
The FBI advised providers to continue monitoring their web servers for unusual activity, including PHP processes that launch unexpected command shells or download unanticipated files. The official PHP website has additional guidance and recommendations.
The FBI said affected systems should be isolated and that web server and PHP logs should be preserved. As with other cybersecurity incidents, suspicious activity can be reported to a local FBI field office or the Internet Crime Complaint Center at ic3.gov. Operated by the FBI, IC3 serves as a central destination for reporting cybercrime.