On October 23, 2026, the FBI warned about two critical flaws in PHP, a widely used programming language that runs websites and web apps. Attackers could use them to run their own code on your server. This short video covers what a small business with a website should do now.
It is for small-business owners and office managers whose website or web app runs on PHP, or who don't know what their site runs on.
Read the full guide: FBI PHP vulnerability warning: check your website
The warning
The FBI public service announcement I-102326-PSA covers two flaws: CVE-2026-109618 and CVE-2026-109619.
How serious it is
On October 26, 2026, CISA, the U.S. cybersecurity agency, added both flaws to its catalog of known exploited vulnerabilities. CERT-EU Security Advisory 2026-018 says early proof-of-concept code has started to circulate, which raises the likelihood that attackers are already using them.
The fix is out
The PHP team released updates on October 21, 2026. Ask whoever runs your site one question: is our PHP on a fixed version? According to CERT-EU, the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Four steps from the FBI
- Update right away, following php.net.
- If you can't, take the system offline until it's fixed.
- List where PHP runs, starting with anything open to the internet.
- Watch your server for strange activity.
If you see signs of a break-in
Isolate the system, keep your server and PHP logs, and report it to your local FBI field office or at ic3.gov.
This page is information, not legal advice.