FBI PHP Vulnerability Warning: Check Your Website

Checked on November 4, 2026

The FBI warned on October 23, 2026, that two critical PHP core vulnerabilities could let attackers remotely run code and break into systems. Security updates are available, and the FBI says affected installations should be updated immediately. If you own a small-business website, first ask your hosting company or developer whether the site uses PHP and whether its PHP installation has been updated. If the answer is unclear, ask for the exact version and written confirmation that the applicable fix was installed.

What did the FBI warn about?

On October 23, 2026, the FBI published public service announcement I-102326-PSA about critical vulnerabilities in PHP, following its first social media warning on October 21. The FBI announcement on ic3.gov describes PHP as a widely used programming language that powers websites and web applications.

The FBI identifies CVE-2026-109618 and CVE-2026-109619. According to the agency, the flaws could allow malicious actors to execute their own code remotely in PHP core, potentially compromising sensitive data and networks. The FBI says attackers could use the flaws to break into systems, putting sensitive information and business operations at risk.

The FBI says security updates are available and should be applied immediately, and it tells business owners and website operators to check whether their systems are affected. The announcement does not give a number of attacks, victims, or affected sites, and it does not name WordPress, another content management system, or any hosting company.

Is my small-business website affected?

Many small-business websites use PHP through WordPress, another site platform, or a hosting provider. That is why a business owner may need to ask the company or person managing the server, even when the owner never works with PHP directly. WordPress and hosting providers are part of this article's practical context, not products named in the FBI warning.

According to the CERT-EU security advisory cited by the FBI, every PHP installation that serves web requests is at risk. CERT-EU specifically includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed among the server setups covered by that statement.

Do not guess from the way the website looks. Ask whoever manages the hosting environment whether the production site serves web requests through PHP, which version is running, and whether the fix has been installed and checked. If a vendor product includes PHP inside it, include that product in the check too, following the FBI's advice to inventory products that bundle PHP.

What does CERT-EU add?

CERT-EU says the PHP team released fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These version numbers come from CERT-EU, not from the FBI. Ask the person responsible for the server which branch applies to your installation and whether the running production version is one of the fixed releases.

CERT-EU also says technical details are being discussed publicly and initial proofs of concept have begun to circulate. CERT-EU says this raises the likelihood that attackers are already exploiting the vulnerabilities. CISA, the U.S. cybersecurity agency the FBI points readers to, added both vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, 2026, which means it has evidence they are being exploited. CERT-EU advises immediate patching and, when that is not possible, isolating internet-facing applications from public networks until a fix is applied and verified.

What should I do first?

The following actions come directly from the steps in the FBI PHP warning. A small-business owner can send this list to the hosting company, web developer, or IT provider and ask who owns each action.

1. Update affected PHP installations immediately. The FBI says to follow the guidance on php.net.
2. Take the system offline if it cannot be updated now. The FBI recommends keeping it offline until the problem is fully fixed.
3. List every place PHP runs. The FBI says to start with internet-facing systems and vendor products that bundle PHP.
4. Watch the web server for suspicious activity. The FBI's examples include PHP processes unexpectedly opening command shells or downloading files.

For a business owner who does not manage the server, the first useful result is a written status from the responsible provider. It should identify the production PHP version, say whether the applicable update is installed, and explain what will happen if the update cannot be completed immediately.

Also ask whether the check covers more than the public website. The FBI's inventory step includes every place PHP runs, with priority given to systems exposed to the internet and to vendor products with PHP built in. Your provider can determine what is present in the environment.

What do I ask my hosting company or web developer?

This checklist is practical advice from this article, based on the FBI's update, inventory, monitoring, isolation, and log-preservation steps and on the fixed versions listed by CERT-EU. It is not a quotation from either organization.

• Does my production website serve web requests through PHP?
• What exact PHP version is running on the production server now?
• Is that version one of the applicable fixed releases listed by CERT-EU?
• When was the update installed, and how did you verify that production is running it?
• Are there other internet-facing systems or vendor products in my account that bundle PHP?
• Have you checked the web server for the suspicious activity described by the FBI?
• If the update cannot be applied now, will you take the affected system offline or isolate the application from public networks?
• Are the web server and PHP logs available if signs of compromise are found?

Ask for direct answers rather than a general statement that the site is secure. A useful reply names the running version, the update status, the systems checked, and the person or company responsible for the next action.

If your host manages PHP for you, the host should be able to answer the server questions. If a developer controls a separate server or vendor product, include that developer in the same check. The goal is one clear inventory, not several assumptions about who handled it.

Related warnings for small businesses

This PHP alert concerns website software, while several other current warnings concern criminals who impersonate trusted people or organizations through other channels. PATech Labs has separate coverage of an FBI warning about fraudulent election messages and an FBI warning about callers impersonating police. Neither article is about PHP.

Our article on scammers impersonating companies in advertisements is another adjacent topic, not PHP guidance. Keeping control of your own website gives customers an official place to compare what they see in a message, call, or advertisement with information your business publishes.

How can customers reach you if the site is offline?

If the website has to be temporarily taken offline, SkyAria Voice Assistant can answer incoming business calls around the clock on the business's existing number, understand the request, book appointments, and pass written context to the team so the phone channel remains available.

FAQ about the FBI PHP warning

What if I can't update right away?

If an immediate update is not feasible, the FBI recommends taking the affected system offline until it is fully fixed. If immediate patching is not possible, CERT-EU advises isolating internet-facing applications from public networks until a fix is applied and verified.

Ask your provider which protective action it is taking, who approved it, and when the fix will be verified. An unknown update status is a reason to get a specific answer from the person responsible for the server.

What if I think my site was hacked?

The FBI announcement says that if signs of compromise are found, affected systems should be isolated and web server and PHP logs should be preserved. The FBI says to report the incident to a local FBI field office or at ic3.gov.

Tell the hosting company or security provider not to discard the relevant logs while it isolates the affected system. The server activity the FBI tells organizations to monitor includes PHP processes that unexpectedly launch command shells or download files.

Does the FBI say my WordPress site is affected?

The FBI warning does not name WordPress or any other content management system. It tells business owners and website operators to check whether their systems are affected, while CERT-EU says every PHP installation that serves web requests is at risk.

Ask your host or developer whether the site serves requests through PHP and what version runs in production. The answer should come from the managed environment, not from an assumption based only on the site's platform name.

Where can I follow official updates?

The FBI directs readers to PHP's announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA's Known Exploited Vulnerabilities catalog for the latest information.

For your own site, pair those official references with a direct status from the company or person managing PHP. The key business question is whether the affected installation you rely on has received and verified the applicable fix.

What is the practical takeaway?

Get a specific answer about whether your website uses PHP, which version is running, and whether the applicable security update is installed. If an immediate update is impossible, the FBI says to take the affected system offline, while CERT-EU advises isolation from public networks until the fix is applied and verified.

The warning calls for prompt action, but the action is concrete: identify where PHP runs, update it, monitor the server, preserve logs if compromise is suspected, and report signs of a break-in. This article provides general information, not legal or professional security advice.