PHP Security Alert: What US and Indian Government Warnings Mean for Websites

PHP Security Alert: What US and Indian Government Warnings Mean for Websites

Website owners, hosting providers and organisations worldwide have been urged to take immediate action after two critical vulnerabilities were identified in the PHP programming language. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could potentially allow remote attackers to execute malicious code on vulnerable servers, creating serious risks for websites and online services.

On October 21, 2026, India’s Computer Emergency Response Team (CERT-In) issued a critical-severity warning about the vulnerabilities, while the US National Security Agency (NSA) urged organisations to prepare for urgent security updates. Security teams were advised to identify affected systems, install available patches and consider temporarily isolating or taking vulnerable services offline if immediate remediation was not possible.

The PHP development team released security fixes addressing both flaws after the vulnerabilities were identified on October 20. The incident has raised concerns about the security of the software infrastructure supporting websites, online applications and digital services, particularly as PHP remains widely used across the internet.

The vulnerabilities also highlight the growing role of artificial intelligence in Cybersecurity research. AI-assisted techniques helped researchers identify weaknesses in PHP’s underlying code, demonstrating how emerging technologies can improve vulnerability discovery while potentially accelerating the development of attacks if flaws are not fixed promptly.

What Is the PHP Security Alert About?

The security alert concerns two vulnerabilities in PHP, an open-source programming language used to develop dynamic websites and web applications. Under certain conditions, the flaws could cause vulnerable PHP installations to mishandle memory or retain invalid internal state, potentially allowing an attacker to execute code on a server.

The two vulnerabilities are identified by the following Common Vulnerabilities and Exposures (CVE) numbers:

• CVE-2026-109618: A vulnerability involving out-of-memory corruption.
• CVE-2026-109619: A vulnerability involving stale global state.

Both flaws affect important parts of PHP’s request-processing and memory-management mechanisms. Their potential impact is particularly concerning because PHP can operate beneath multiple applications on the same server, meaning a weakness in the language’s core engine may affect more than one website or service.

The reported severity score was 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS) version 4.0. This places the vulnerabilities in a serious category requiring prompt attention from system administrators and security teams.

However, the existence of a vulnerable software version does not automatically mean that a server has been compromised. Actual exposure depends on the PHP version, server configuration, deployment architecture and whether the relevant vulnerable code paths can be reached.

Why Have US and Indian Cybersecurity Agencies Issued Warnings?

The warnings from US and Indian cybersecurity agencies reflect the potential consequences of vulnerabilities affecting widely deployed software. PHP is used to power websites, content management systems, application backends and other internet-facing services. A critical weakness in its underlying engine can therefore create security concerns across different industries.

India’s CERT-In Issues a Critical-Severity Advisory

The Indian Computer Emergency Response Team, commonly known as CERT-In, issued an advisory on October 21, 2026, warning that the vulnerabilities could allow remote attackers to execute malicious code on affected systems.

The warning is relevant to Indian organisations that operate public-facing websites, digital platforms and online services. Businesses handling sensitive information, including financial institutions, insurers and payment service providers, should pay particular attention to systems that use vulnerable PHP installations.

Organisations should identify the affected assets, review the official security advisory, install the appropriate PHP updates and check whether third-party vendors or service providers manage any of their exposed systems.

Updating a website’s content management system alone may not resolve the problem. If the underlying server continues to run a vulnerable PHP version, the core software weakness may remain even after the website application itself has been updated.

US NSA Urges Organisations to Prepare for Immediate Updates

The US National Security Agency also urged organisations to respond quickly to the PHP vulnerabilities. The guidance emphasised the importance of applying security updates and considering taking vulnerable systems offline when they cannot be patched promptly.

Temporarily suspending an affected service can disrupt normal operations, but it may be necessary when a critical vulnerability cannot be addressed immediately and the risk of leaving the system exposed is unacceptable.

For organisations with large server environments, the response may require coordination between IT administrators, application developers, cloud providers and security teams. Administrators need to establish which systems are affected, prioritise exposed services and confirm that patches have been installed successfully.

What Is PHP and Why Does It Matter for Website Security?

PHP is an open-source, server-side programming language used to build dynamic websites and web applications. Unlike client-side code that runs in a visitor’s browser, PHP generally executes on a server, where it can process requests, interact with databases and generate content that is sent to users.

PHP supports numerous websites and application environments. Popular platforms and frameworks, including WordPress and Laravel, rely on PHP in their technology stacks.

When a visitor opens a PHP-powered website, the server may execute PHP code to retrieve information, process a form, authenticate a user or display personalised content. The language’s underlying engine is responsible for handling these operations.

This architecture explains why vulnerabilities in PHP itself can be more consequential than a weakness confined to a single application. If multiple websites depend on the same vulnerable PHP installation, they may share an underlying security risk.

The PHP security announcement addressed installations serving web requests through several configurations and environments, including PHP-FPM, Apache with mod_php, php_cgi, FrankenPHP and LiteSpeed.

Not every PHP deployment necessarily has the same exposure. The relevant software version and server configuration must be checked before determining whether an individual system is affected.

What Is CVE-2026-109618? Understanding the Out-of-Memory Vulnerability

The first vulnerability, CVE-2026-109618, involves out-of-memory corruption. It relates to how PHP handles memory when processing requests and encounters particular conditions involving memory allocation.

Programs use memory to store information temporarily while executing instructions. When a program cannot allocate memory as expected, it must handle that failure safely. Problems can arise if internal data is left only partially initialised and the program later treats it as valid information.

In the reported PHP vulnerability, a failure in memory allocation can potentially disrupt normal processing. During subsequent cleanup, PHP may handle invalid internal data as though it were legitimate, creating conditions that could result in memory corruption.

Memory corruption can be security-critical because it may interfere with the program’s normal execution. Under certain conditions, an attacker could potentially exploit the problem to execute malicious code on a vulnerable server.

The precise consequences depend on the affected installation and its configuration. Nevertheless, the possibility of remote code execution makes the vulnerability particularly serious for systems that process requests from the internet.

What Is CVE-2026-109619? Understanding the Stale Global State Flaw

The second vulnerability, CVE-2026-109619, involves stale global state within PHP’s request-processing environment.

Applications and programming languages frequently use internal references to manage data in memory. When a request finishes, information associated with that request may need to be released or reset before another request is processed.

A problem can occur if a program retains a reference to memory that has already been released or fails to reset internal state correctly. A later request handled by the same worker may then interact with information that should no longer be available.

In PHP’s case, the reported flaw can cause internal data to be handled incorrectly under certain conditions, potentially creating a security risk.

The issue highlights the importance of properly managing memory and resetting internal state between requests. Even if an application appears to function normally, an underlying programming-language flaw can create a pathway for unexpected behaviour.

Both CVE-2026-109618 and CVE-2026-109619 affect core PHP mechanisms rather than necessarily being limited to a particular website’s application code. Administrators should therefore check their PHP runtime and deployment environment instead of assuming that application-level security measures alone will address the problem.

What Is Remote Code Execution and Why Is It Dangerous?

Remote code execution, commonly abbreviated as RCE, is a security vulnerability that may allow an attacker to run code or commands on a computer or server from a remote location.

RCE vulnerabilities are considered especially serious when an attacker can exploit them through an internet-facing service without first obtaining legitimate access to the system.

If an attacker successfully exploits a vulnerable PHP installation, the potential consequences could include:

• Data theft: Access to sensitive information stored on the affected server, depending on permissions and configuration.
• Website manipulation: Unauthorised changes to website content, files or application behaviour.
• Malware installation: Attempts to install malicious software or establish a foothold on the compromised system.
• Credential exposure: Access to application secrets, database credentials or other sensitive information available to the compromised process.
• Further system compromise: Attempts to exploit the server’s access to other systems or services.
• Service disruption: Actions that affect website availability or interfere with normal business operations.

These are potential outcomes, not confirmation that every affected server will experience them. The level of access available to an attacker can depend on the privileges assigned to the PHP process, the server’s configuration and additional security controls.

Even so, the combination of remote exposure, widespread software use and the potential for code execution explains why security agencies have urged organisations to prioritise the fixes.

How Many Websites Could Be at Risk?

The potential reach of the vulnerabilities is a major concern because PHP is widely deployed across the internet. Security researcher Satnam Narang, a research engineer at Tenable, said the company had classified the flaws as “Vulnerabilities of Concern”, its highest classification level.

The classification reflects the seriousness of the flaws and PHP’s widespread use. Some estimates suggest that approximately 70% of websites use PHP in some capacity, although that figure does not establish how many websites run a vulnerable version or are exposed to the specific flaws.

Determining the actual number of affected systems requires more detailed information about installed versions, server configurations and deployment environments. A website may use PHP without running a vulnerable version, while another may depend on a server managed by an external hosting provider.

Organisations should avoid treating broad estimates of PHP adoption as a direct measure of the number of compromised or vulnerable websites. Instead, they should conduct asset inventories and version checks to establish their actual exposure.

Internet-facing services should generally receive early attention because they may be reachable by remote attackers. However, internal systems and applications managed by third-party vendors should also be assessed where they use the affected PHP runtime.

How Did Artificial Intelligence Help Researchers Discover the Vulnerabilities?

The discovery of the PHP vulnerabilities illustrates the growing role of artificial intelligence in software security research.

According to the PHP Foundation, the discovery process involved coordinated research, including work associated with external security audits and OpenAI-backed Patch the Planet initiative. Researchers at cybersecurity firm Calif and OpenAI independently reported the out-of-memory vulnerability, while Wiz contributed additional findings.

Narang also said that AI assistance played a role in discovering the flaws. The development reflects how modern AI systems can help researchers analyse complex codebases, identify suspicious patterns and investigate potential weaknesses in software.

AI-assisted security tools can help researchers examine memory-handling routines, identify inconsistencies and explore code paths that might otherwise require extensive manual analysis. These capabilities can make vulnerability research more efficient, particularly in large and complicated projects.

However, identifying a possible flaw is only one stage of responsible security research. Researchers and software maintainers still need to reproduce the issue, determine its severity, develop an appropriate fix and test that fix across relevant environments.

The PHP Foundation acknowledged that resolving the out-of-memory vulnerability involved difficult trade-offs, including compatibility, performance and the possibility of introducing additional problems through a change.

The disclosure timeline also changed after the CVE identifiers reportedly leaked, bringing the announcement forward by a day. Additional information that emerged after the leak helped accelerate the development of proof-of-concept exploits, according to Narang.

The incident demonstrates both the defensive benefits and the potential risks of AI-assisted security research. AI can help developers find and fix vulnerabilities more quickly, but similar capabilities may also help malicious actors investigate flaws and develop exploits. Rapid patching, careful testing and responsible disclosure remain essential.

What Should Indian Organisations Do to Protect Their Websites?

Indian organisations should treat the PHP vulnerabilities as an urgent software-maintenance issue, particularly if they operate public-facing services or handle sensitive customer information.

Ranjeet Rane, Partner at The Dialogue, recommended identifying affected systems, applying security patches and checking third-party vendors. He also emphasised that updating a content management system does not necessarily resolve a vulnerability in the underlying PHP engine.

Organisations should begin by establishing where PHP is used across their infrastructure. This includes production servers, staging environments, containers, internal applications and systems operated by service providers on their behalf.

After identifying the relevant systems, administrators should determine the installed PHP versions and compare them with the official security guidance. Appropriate updates should then be applied and verified.

Where immediate patching is not possible, security teams should assess whether access can be restricted or affected services temporarily suspended. The appropriate response depends on the system’s exposure, operational importance and the availability of compensating security measures.

Organisations should also monitor CERT-In advisories for additional guidance as the incident develops.

More Than 50,000 PHP Assets Identified in India: What Does It Mean?

Beenu Arora, CEO and Co-founder of Cyble, said an online scan identified more than 50,000 internet-facing assets running PHP in India, including 159 government assets exposed to the internet.

These figures indicate the scale of PHP’s internet-facing footprint, but they should not be interpreted as a count of vulnerable or compromised systems. An internet-facing asset may be running a secure version of PHP or may not be exposed to the specific conditions required to exploit either flaw.

Arora recommended upgrading PHP immediately, moving away from unsupported versions and checking exposed systems for possible signs of compromise. He also advised prioritising internet-facing applications, particularly those using Apache mod_php.

Organisations that maintain their own PHP container images should rebuild and redeploy them using patched versions. Updating a running application without updating the underlying image may leave outdated software in the deployment pipeline or in replacement containers created later.

If an organisation cannot patch a vulnerable system immediately, it should consider isolating the application or taking it offline until the risk can be addressed. Any temporary mitigation should be reviewed against official security guidance rather than treated as a permanent substitute for installing the fix.

Why Application-Level Security May Not Be Enough

Niv Lanyado, who leads PHP-related security research at JFrog, warned that traditional application-level safeguards may not stop this type of vulnerability because the flaw affects the core PHP engine before application code executes.

This distinction matters because many website owners rely on application firewalls, input validation, authentication controls and other safeguards to protect their platforms. These measures remain valuable, but they do not necessarily eliminate a vulnerability in the runtime that processes incoming requests.

Organisations should therefore combine application-level protection with secure software maintenance. This means identifying the PHP runtime, checking its version, installing the relevant fixes and verifying that the deployment is using the patched software.

Security teams should also review logs and other available telemetry for suspicious activity, particularly if a system remained exposed after the vulnerability became known. If there are indications of compromise, the organisation should follow its incident-response procedures instead of assuming that patching alone resolves any earlier intrusion.

What Should Organisations Know About Supply-Chain Security?

The PHP incident also draws attention to software supply-chain risks. Modern applications often rely on multiple layers of dependencies, including programming languages, frameworks, libraries, container images and third-party services.

A weakness in one component can affect applications that depend on it, even when the application developers did not introduce the original flaw. Similarly, deploying an outdated container image or relying on an unsupported runtime can undermine otherwise sound security practices.

Guy Korolevski, a researcher working on LiteLLM, highlighted the importance of verifying software packages and checking their versions before they enter the build process.

Korolevski also advised organisations that had used LiteLLM version 1.107.0 in an environment to rotate accessible credentials and rebuild affected systems. This is a separate, version-specific precaution and should not be confused with the PHP vulnerabilities themselves.

The broader lesson is that organisations should maintain accurate software inventories, verify package versions and rebuild deployments when required. Credentials should be rotated when exposure or compromise is suspected or when the relevant security guidance recommends doing so.

What Should WordPress and Laravel Website Owners Do?

Owners of websites built with PHP-based platforms should check both their application software and the PHP runtime provided by their hosting environment.

For WordPress websites, updating WordPress core, themes and plugins remains important, but those updates do not necessarily patch the PHP engine running on the server. Website owners should check their hosting provider’s security notices and confirm that the server is using an appropriate patched PHP version.

Laravel users should pay particular attention to how their applications are hosted and deployed. According to the information provided by the relevant service providers, Laravel Cloud reported automatic patching of running applications, while Forge users were instructed to update PHP manually. Vapor users needed to redeploy applications in line with their runtime configuration.

These differences mean that there is no single update procedure suitable for every Laravel deployment. Website owners should follow the instructions for their specific hosting service and confirm that the active runtime has been updated.

After applying the necessary fixes, administrators should check that websites are functioning correctly, review deployment settings and verify that newly started application instances are also running patched software.

Step-by-Step PHP Security Checklist for Website Owners

Website owners and system administrators can use the following checklist to organise their response to the PHP security alert.

• Identify PHP installations: Inventory all servers, containers and applications that use PHP.
• Check installed versions: Determine which PHP versions are running in production and other environments.
• Review official advisories: Consult PHP’s security announcements, CERT-In guidance and hosting-provider notices.
• Install security updates: Upgrade affected installations to a fixed version appropriate for the environment.
• Verify the active runtime: Confirm that the web server, PHP-FPM workers, containers and application instances are using the patched version.
• Check third-party providers: Ask hosting companies and managed-service providers to confirm whether their infrastructure has been updated.
• Prioritise exposed services: Address internet-facing applications and systems handling sensitive data as a priority.
• Isolate systems if necessary: If a critical system cannot be patched promptly, assess whether access should be restricted or the service temporarily taken offline.
• Inspect for suspicious activity: Review relevant logs and security alerts, especially if the system remained exposed after disclosure.
• Rebuild outdated deployments: Rebuild self-managed containers and deployment images where required to ensure that patched software is used.
• Test after patching: Confirm that the website and its essential functions continue to operate correctly.
• Document the response: Record affected assets, installed fixes, verification results and any remaining risks.

This checklist is a practical starting point rather than a replacement for the official technical instructions applicable to a particular PHP release or deployment.

Frequently Asked Questions About the PHP Security Vulnerabilities

1. What are the two PHP vulnerabilities announced in October 2026?

The two vulnerabilities are CVE-2026-109618, which involves out-of-memory corruption, and CVE-2026-109619, which involves stale global state. Under certain conditions, both flaws could create security risks in affected PHP installations.

2. Can the PHP vulnerabilities allow hackers to execute malicious code?

Yes. The vulnerabilities were reported as potentially enabling remote code execution on vulnerable servers under certain conditions. Successful exploitation could allow an attacker to run code with the privileges available to the affected process. The actual impact depends on the server’s configuration and security controls.

3. Why did CERT-In issue a warning?

CERT-In issued a critical-severity advisory on October 21, 2026, warning that the flaws could allow remote attackers to execute malicious code on affected systems. The warning encourages organisations in India to identify vulnerable installations and apply appropriate security measures.

4. Is every PHP-powered website vulnerable?

No. PHP’s widespread use does not mean that every PHP-powered website is vulnerable. Exposure depends on the installed version, configuration and other technical conditions. Website owners should check official security guidance and their actual runtime versions.

5. Will updating WordPress fix the PHP vulnerabilities?

Not necessarily. Updating WordPress core, themes and plugins is important, but it does not automatically update the PHP runtime used by the hosting server. Website owners should also confirm that their hosting provider has installed the appropriate PHP security updates.

6. What should website owners do if they cannot install a patch immediately?

They should review official security guidance and assess whether the affected service can be isolated, access-restricted or temporarily taken offline. The decision should account for the system’s exposure and operational importance. Temporary mitigation should not replace patching once a suitable fix can be applied.

7. Did AI help researchers discover the PHP vulnerabilities?

Yes. Researchers used AI-assisted methods as part of the discovery process, according to the reported findings. AI can help analyse complex code and identify potential weaknesses, but engineers must still validate vulnerabilities, develop fixes and test the resulting updates.

8. What is the safest next step for a website owner?

Identify the PHP version running on the server, consult the official security announcement, install the applicable security update and verify that the active environment is patched. If the website is managed by a hosting provider, request confirmation of the update and follow any service-specific instructions.

Conclusion: Immediate PHP Updates Are Critical for Website Security

The two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have prompted urgent warnings from cybersecurity agencies in India and the United States because they could potentially allow remote code execution on affected servers.

The incident demonstrates why maintaining the underlying software that powers websites is just as important as updating applications, plugins and content management systems. A secure website depends on the complete technology stack, including its programming-language runtime, dependencies, deployment images and server configuration.

AI-assisted research has helped demonstrate how quickly vulnerabilities can be discovered in complex software. However, discovery alone does not make systems safer. Organisations must identify affected installations, apply the appropriate patches, verify their deployments and investigate potential signs of compromise where necessary.

For website owners, hosting providers and Indian organisations, the priority is clear: check whether PHP is used in the environment, establish whether the installed version is affected, follow official security guidance and ensure that the required updates are applied without delay.

Tighten the article for faster reading Add a prominent update-action summary Reduce repeated patching advice