Why companies should take the latest FBI cyber warning seriously…like top priority serious.

Two critical security flaws have been discovered that can let attackers take over a web server remotely without logging in. The flaw was found in PHP core a technology used by a significant portion of the internet, this very likely includes you.

What does this all mean in plain English?

The security flaw allows for “Remote code execution” which means a stranger on the internet can potentially take control of your server. According to the PHP project’s October 21, 2026 security advisory, these flaws work without a login, and on one common setup (Apache with mod_php) the attack can fire before your website’s own code even runs.

The PHP project says there are no complete workarounds: “updating is the only safe choice.” Plugins, firewalls and security settings can’t fully protect you.

Right now hacker bots are scouring the internet seeking outdated systems and launching automated attacks on them, so it is important that you act fast before those bots reach your server.  An update is A LOT cheapier than dealing with a compromised system.

Who is affected?

The PHP advisory says the risk covers “all PHP installations serving web requests,” including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. That covers:

• Self hosted sites, so if you have a  wordpress or ecommerce and your paying only for the server (GoDaddy, AWS, GCP, etc).  If you pay for services that include managed servers such as shopify, wix, etc then you dont need to worry.
• Shared hosting customers, whose host controls the PHP version.
• Sites on old PHP versions (8.1 and older), which no longer get updates from the PHP project.

How many websites run outdated PHP?

A lot. PHP powers a majority of the internet, and many are not regularly updating.

What did the FBI say?

In a public post on October 21, 2026, the FBI wrote:

“Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.”

The FBI asks organizations to:

• Immediately update affected PHP installations following the guidance on php.net.
• Take the system offline until it can be fully mitigated, if an immediate update isn’t feasible.
• Inventory where PHP runs, starting with internet-facing systems and vendor products that bundle PHP.
• Watch web servers for suspicious activity, such as PHP unexpectedly launching command shells or downloading files.
• If you find signs of compromise, isolate the system, keep your logs, and report it to your local FBI field office or ic3.gov.

Which PHP versions are fixed?

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older than those is exposed.

Plan ahead, too: PHP 8.2 stops receiving security fixes on December 31, 2026, and PHP 8.3 on December 31, 2027.

What could happen to my business?

• Customer data, logins or payment details stolen from your site.
• Your site defaced, redirected to scams, or used to send spam.
• An attacker can create back door into your server, and reenter at a later date to conduct criminal activity, or launch SPAM campaigns that will effect your domains reputation, resulting in no longer appearing on search engines or your emails to your customers being flagged as spam.
• Attackers using your server as a foothold into the rest of your network.
• Google warnings on your site and lost customer trust.

What should I do right now?

1. Find your PHP version. If you are running WordPress, go to Tools → Site Health → Info → Server. Or run php -v from server terminal to see what PHP version you are running, Or ask your host.
2. Update to a patched release (8.5.12, 8.4.27, 8.3.36 or 8.2.35). If you’re on 8.1 or older, plan a move to a supported version.
3. Ask your host in writing whether they’ve applied the fix, if you’re on shared hosting.
4. Back up your site before and after the upgrade.
5. Check for signs of compromise and report anything suspicious to ic3.gov.

Can you upgrade my PHP for me?

Yes. Internet Technology Services can help: we check your version, back up your site, test your themes and plugins on the new version, apply the update, and review the server for signs of compromise.

Call (949) 446-1716 or email its@internettechnologyservices.com to get your  system checked.

FAQ

Is my WordPress site affected by the PHP vulnerabilities?

Almost certainly, unless your PHP has already been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. WordPress runs on PHP, so the flaws are in the server underneath your site.

Will a security plugin protect me?

No. The PHP project says there are no complete mitigations and updating is the only safe choice, and one attack path triggers before WordPress code runs.

I’m on shared hosting. Is this my host’s job?

Usually your host updates PHP, but many let you pick an older version. Confirm with your host that you’re on a patched release.

What if I’m on PHP 7 or 8.1?

Those versions no longer get updates from the PHP project. You need to move to a supported version, which can require plugin and theme fixes.

Where do I report a hacked server?

The FBI asks you to report it to your local FBI field office or at ic3.gov, and to keep your web server and PHP logs.

We urge everyone to take this warning seriously and act with urgency, as hacker bots are scouring the internet seeking vulnerable systems and launching automated attacks. Dealing with a compromised system is very expensive to resolve and can be very stressful for business owners.  Call (949) 446-1716 or email its@internettechnologyservices.com to get your site checked.