NSA, CISA and FBI Urge Immediate Patching of Critical PHP Vulnerabilities

On October 21, 2026, PHP developers issued emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could allow attackers to execute commands on affected servers without authentication. The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) urged organizations to remediate immediately. The warning applies to government systems and contractor-managed services that use PHP, including internet-facing websites and hosted environments. Because PHP commonly operates beneath content-management platforms, updating a website’s application or plugins alone may not address a vulnerable PHP runtime.

The urgency reflects both PHP’s broad adoption and observed attack activity. Reporting cited an estimate of 12.8 million internet-accessible services in the United States potentially affected, while other coverage described PHP as underpinning about 75% of websites whose programming language can be identified. Cloudflare CEO Matthew Prince reported thousands of attempts across the company’s network during the 10 hours before formal disclosure, rising to hundreds of thousands within two hours afterward and eventually to millions. Cisco Talos also observed attempts soon after disclosure, and Arctic Wolf detected efforts to make targeted servers download additional software, though it could not confirm that the downloads succeeded. These figures describe attempts and potential exposure—not confirmed compromises.

The disclosure timeline adds to the operational pressure. Information about the flaws reportedly surfaced online before the planned release, prompting PHP developers to accelerate distribution of fixes by a day. Cloudflare reported pre-disclosure attempts, including requests altered to evade protections. Talos assessed that much of the observed activity involved scanning for vulnerable systems, alongside scattered attempts to deliver software, and the available reporting does not establish widespread successful exploitation. As Fastly Chief Product Officer Kelly Shortridge put it, “The gap between disclosure and widespread, repeatable exploitation is typically hours to a few days for vulnerabilities of this severity and attack ROI.” That assessment supports rapid action without treating attempted exploitation as proof of a breach.

For federal agencies, prime contractors and subcontractors, the immediate procurement implication is a short-notice need to locate affected runtimes, coordinate patching with hosting providers, test compatibility and verify mitigations. Systems that cannot be secured promptly should be taken offline or isolated, according to the advisories summarized in the source material. Older applications may need additional testing before upgrades, and service restoration may require technical support. The advisories do not announce a solicitation, award, dedicated funding or procurement authorization; any resulting work would need to proceed through an organization’s existing acquisition and cybersecurity processes. Vendors supporting affected environments may see demand for assessment and remediation services, but no specific contract opportunity or deadline is identified.

• Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 are critical PHP flaws that may enable unauthenticated remote command execution.
• Fix availability: PHP released emergency fixes on October 21, 2026, after the planned release was reportedly moved forward by a day.
• Federal direction: The NSA, CISA and FBI urged immediate updates or disconnection/isolation of systems that cannot be secured promptly.
• Exposure estimate: Source reporting cited 12.8 million potentially affected internet-accessible services in the United States; this is an exposure estimate, not a confirmed breach count.
• Observed activity: Cloudflare reported activity climbing from thousands of attempts before disclosure to hundreds of thousands within two hours and millions overall; attempted exploitation does not establish successful compromise.
• Runtime dependency: Inventory PHP beneath platforms such as WordPress, Drupal, Joomla and Magento; updating a platform or its plugins alone may leave the underlying runtime vulnerable.
• Operational response: Coordinate with hosting providers, apply fixes to supported versions, test compatibility, verify mitigation and restore services; isolate or take offline systems that cannot be patched promptly.
• Contracting signal: Vulnerability assessment, patch deployment, compatibility testing and mitigation verification may create support needs, but the advisories identify no specific solicitation, funding, award or deadline.