NSA warns of two critical PHP vulnerabilities, urges immediate updates

The US National Security Agency (NSA) warned of two critical vulnerabilities in the PHP programming language that could allow attackers to execute commands remotely and take control of web and application servers, according to a report followed by the Iraqi News Agency.

The report said the warning was issued on Wednesday and identified the two vulnerabilities as CVE-2026-109618 and CVE-2026-109619, with a severity rating of 9.2 out of 10, noting that the danger lies in the vulnerabilities being in PHP itself rather than in specific plugins or content management systems.

It warned that exploiting the vulnerabilities could lead to access to sensitive data such as passwords, security tokens, and API keys, and could also allow manipulation of site content and access to user information.

Security tests showed the vulnerabilities could be exploited in environments running content management systems such as WordPress, Drupal, and Joomla, although the vulnerabilities are not present in those systems themselves but in the programming language they rely on.

The report noted the discovery came with the participation of specialized research teams including the companies Kalif and Wez, in cooperation with the PHP development team and OpenAI, and said that artificial intelligence tools contributed to analyzing code faults and uncovering exploitation paths.

It added that some of the bugs causing these vulnerabilities date back more than ten years, but the complexity of exploiting them prevented their dangerousness from being detected earlier.

The PHP development team issued urgent security updates to address the vulnerabilities covering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the report urged organizations and site owners to install these updates immediately, warning that temporary mitigations do not provide complete protection.