Suggested slug: nsa-php-vulnerabilities-warning
Category: Technology
Focus keyphrase: NSA PHP vulnerabilities warning
SEO title: NSA Warns of Critical PHP Vulnerabilities (40 chars)
Meta description: The US National Security Agency has urged website owners to patch two critical PHP flaws, dubbed PHP2Shell, or take vulnerable sites offline at once. (148 chars)
Tags: NSA warning, PHP vulnerabilities, PHP2Shell, cybersecurity, WordPress security, website security, CVE-2026-109618
Original element: genuine update — the NSA’s US-government warning (Oct 21) with the PHP2Shell name, AI-assisted discovery details and exact patched version numbers, building on our Oct 21-22 PHP coverage (linked below)
NSA Warns Website Owners to Patch Critical PHP Flaws or Go Offline
WASHINGTON: The United States National Security Agency has urged organisations running websites on PHP to install emergency security updates at once, warning that two critical vulnerabilities could let attackers seize control of web servers without needing login credentials.
The agency issued the warning on Wednesday, October 21, saying website operators should update their PHP installations immediately. Where patches cannot be applied quickly, it advised taking vulnerable websites offline until they can be secured. The development was reported by ProPakistani on October 23.
Two flaws named PHP2Shell
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, affect how the programming language manages memory and handles errors. Under certain conditions, attackers can exploit them to run malicious code on servers without authentication.
PHP powers an estimated 70 per cent of websites worldwide, including sites built on popular content management systems such as WordPress, Drupal and Joomla. Successful exploitation could allow hackers to take over servers, read sensitive information and compromise databases.
Security researchers say the underlying problems have existed in PHP versions going back to PHP 5.4, released more than ten years ago. However, not every site running PHP is exposed, since the risk depends on the installed version and the server configuration.
In its advisory, the NSA’s cyber directorate said: “Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities.” It noted that such flaws often give attackers a direct path to a server’s file system.
AI helped find the flaws
Artificial intelligence played a central role in discovering the vulnerabilities.
Cybersecurity firm Calif found one flaw using OpenAI’s GPT-5.6 Sol model through its Patch the Planet programme, while Google’s Wiz team used its Wiz Atlas AI agent, Gemini 4 Argon and GPT-5.6 Sol to identify several PHP weaknesses.
Both teams worked with PHP developers on fixes before disclosure, with Cloudflare, AWS, Akamai, Microsoft, Automattic, Fastly and Vercel also assisting with preparations.
Patches are available now
The PHP Foundation released security updates on October 21 covering the affected branches: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should move to the latest patched release for their branch; sites on unsupported versions face a bigger upgrade.
The NSA also told organisations to identify vulnerable systems, tighten monitoring and temporarily disconnect services that cannot be patched at once.
WordPress has clarified that the flaws are not specific to its platform. Site owners must update the underlying PHP installation, which in most cases means asking their hosting provider to apply the patch.
What it means for Pakistan
The warning follows a similar alert at home. Pakistan’s National Cyber Emergency Response Team (NCERT) issued its own critical PHP warning for Pakistani websites earlier this week, and critical PHP flaws have already forced government websites offline across Europe.
Many Pakistani businesses, news outlets and government portals run WordPress on PHP, so the practical step for most local site owners is the one WordPress recommends: ask the hosting provider to confirm the server runs a patched PHP release.
Pakistan is building capacity in the same space, with KU proposing a Pakistan-China AI and cybersecurity centre and Jazz launching an AI hub with Urdu voice support.
Exploitation not yet confirmed
OpenAI said researchers found the flaws before attackers were known to have exploited them. Even so, experts warn that AI cuts both ways: Wiz noted that AI models can help attackers adapt malicious code to different PHP versions, server setups and memory layouts, lowering the skill needed to strike.
No widespread exploitation had been confirmed at disclosure, but technical details and early proof-of-concept attacks were already circulating, which is why agencies are pressing for immediate patching.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the collective name for two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, which can let attackers run code on web servers without logging in.
Which PHP versions are affected?
The flaws date back to PHP 5.4. The October 21 patches cover the 8.5, 8.4, 8.3 and 8.2 branches. Site owners should ask their hosting provider which version their server runs.
Does this affect my WordPress site?
WordPress says the flaws are not specific to its platform, but WordPress sites run on PHP, so owners should make sure the server’s PHP installation is patched, usually through the hosting provider.
Has anyone been attacked through these flaws?
Researchers discovered them before attackers were known to have exploited them, and no widespread exploitation had been confirmed when the patches were released. Early proof-of-concept code is circulating, so patching remains urgent.
Source: ProPakistani
