Critical PHP Security Vulnerabilities
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) known as php2shell have recently been disclosed that could allow an unauthenticated attacker to execute code on a vulnerable web server. CISA is urging organizations to patch affected systems immediately. [cisa.gov]
What it means for you
If your website uses PHP, it could be at risk of website or server compromise, unauthorized access, data exposure, or service disruption. [blackarrowcyber.com]
Action you should take
Contact your website hosting provider or website administrator immediately and:
- Confirm whether your website uses PHP.
- Verify PHP has been updated to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- If you are running PHP 8.1 or earlier, have your provider move the site to a supported, patched PHP version.
- Prioritize this as an urgent security update.
As always, NGT is here to help!
If you have questions or need assistance coordinating with your website provider, please contact NGT at ngthelp.com.