The FBI has urged organizations to update PHP installations after two critical vulnerabilities were identified in the widely used programming language. The flaws could allow attackers to run code remotely on affected servers, potentially putting sensitive data and networks at risk. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are known collectively as “PHP2Shell.” PHP released security updates on October 21.
In its message, the FBI said the vulnerabilities “could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.” The discovery has also drawn attention to AI’s role in cybersecurity research. Google Cloud said Wiz Research, part of a well-established cloud and AI security company, used multiple AI models to identify and help remediate the vulnerabilities. Wiz said Gemini 4 Argon contributed to vulnerability discovery, exploit development, attack detection and patch validation.
Wiz also credited its own Wiz Atlas system and OpenAI’s GPT-5.6 Sol in its research. Separately, OpenAI said cybersecurity startup Calif used GPT-5.6 Sol to identify one flaw, while Wiz independently discovered and reported both. The FBI said in a post on X on Wednesday that organizations should update affected installations using guidance from PHP.net.
It also said that if an immediate update is not feasible, “it is recommended that organizations take the system offline until it can be fully mitigated.” The FBI advised organizations to inventory where PHP runs, prioritizing systems accessible from the internet and products that bundle PHP. It also urged monitoring for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. The agency said organizations that find signs of compromise should isolate affected systems, preserve server and PHP logs, and report the incident to an FBI field office or IC3.
Newsweek has reached out to the FBI, NSA, PHP Foundation, OpenAI, Calif, Wiz and the U.K.’s National Cyber Security Centre for comment. PHP is an open-source programming language that runs on web servers. Websites and applications use it to generate dynamic pages, process requests and interact with databases.
It is used in content management systems and other web applications, including WordPress. Its wide use means that a flaw in PHP can affect many kinds of online services. W3Techs estimated that PHP was used by 69.3 percent of websites whose server-side programming language it could identify as of October 21.
Extract — continue reading at the source.
