FBI Issues Warning On Major Cybersecurity Threat You Should Know About

We may receive a commission on purchases made from links.

The FBI is asking organizations to update their web servers as soon as possible after two critical vulnerabilities were found in PHP, a programming language that powers a huge number of websites and web apps. The FBI's Cyber Division posted on X that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers remotely run code on servers using PHP and potentially compromise "sensitive data and networks."

Further, the agency also suggested that any organization unable to update right away should take its systems offline to help mitigate the potential risk. The fact that the FBI has even recommended such action should give you an idea of what kind of vulnerability is being dealt with here. Of course, if you don't run your own website, then the risk from this is mostly indirect, as the attack is more focused on taking control of affected web servers without an account or a password.

This would then allow the bad actors to steal sensitive data, disrupt services, or move deeper into a network. While you don't need to stop using your favorite websites as a whole, we do recommend paying attention to your accounts over the next few weeks. And if you've been waiting for a sign to drop dangerous password habits you might have picked up in the past, then now is a good time to start.

PHP is used by about 69% of websites where the server-side programming language is known, and that includes the sites built on WordPress. Because of this, PHP-related issues can affect large chunks of the internet. The two vulnerabilities, which have been nicknamed PHP2Shell, are both memory bugs that show up while PHP is processing web requests.

The PHP team rated both of the issues a 9.2 out of 10 for severity, and it says there is already a demonstrated exploit where a request from someone who isn't logged in can start the attack "before any application code runs." PHP announced the vulnerabilities on October 20 and released fixes the next day in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Unfortunately, getting those updates onto every server running PHP is going to take some time, especially for companies that are still using older versions of PHP without planned official updates.

Attacks also seem to have started before the fixes were even out. Amazon says its honeypot network picked up an attempt to exploit the vulnerabilities on October 17, four days before they were made public, and that PHP2Shell is now being "broadly exploited in the wild." Several government websites in Europe and elsewhere even went offline on October 21 as site operators rushed to secure their servers.

Because the problem is in PHP and not in your phone's or computer's operating system, there isn't an update you can install on your own devices to fix it. That responsibility falls on the companies and hosting providers that run those servers. What you can do is keep an eye on your email for breach notices from companies you have accounts with, and update your password right away if a company says your login information was exposed. If you're still using the same password for multiple accounts, then choosing a secure password manager can make it a lot easier to give every account a unique password.

Setting up passkeys or two-factor authentication is also another good way to help make accessing your accounts more difficult for bad actors. You should also make sure you aren't just relying on outdated cybersecurity tips that no longer keep you safe, and be careful of any emails or texts claiming that there is a problem with your account. If you do receive any notices like that, we recommend going directly to the company's website yourself instead of clicking any links inside the message.

If you run your own website and use PHP, then it's a good idea to look up which PHP version your server is running and verify whether the October 21 updates are installed or not. The PHP team says it put some temporary measures in place that should reduce exposure, but they don't completely mitigate the issue. If you can't update right away, both the FBI and the NSA recommend taking the site offline until you can, which is a pain, but it beats cleaning up after a hacked server.