FBI issues global alert on two critical PHP RCE vulnerabilities, advises taking unpatched systems offline
denisparra · x · 2026-10-22
The FBI's cyber division issued a critical global alert: two vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, could let malicious actors remotely execute code in the PHP core, potentially compromising sensitive data and networks.
Recommended actions:
- If an immediate update isn't feasible, take affected systems offline until fully mitigated;
- Immediately update affected PHP installations per official guidance;
- Inventory where PHP runs in your environment, prioritizing internet-facing systems.
Related event: FBI and NSA Issue Rare Alerts Over Critical PHP RCE Flaws(4 posts)→
More from Safety
- "The threat was never rogue AI—it's humans using AI to hurt humans," answered with the 'Always has been' meme — ericwdolan · 2026-10-22
- FrankenTorch: a memory-safe clean-room Rust rewrite of PyTorch with 6,300+ commits — doodlestein · 2026-10-22
- Dev posts denied Cyber Verification Program screenshot, vows never to pay Anthropic again — arthurcolle · 2026-10-22
- GoFaceless pauses service after Railway hosting security incident — nijfranck · 2026-10-22
- October's Supply Chain Nightmare: 15 Breaches Hit Railway, LiteLLM, OVHcloud — AaronBergman18 · 2026-10-22
- Anthropic alignment team flags 'eval awareness': are models only behaving while being watched? — matiroy · 2026-10-22