Andrea Izzotti/Shutterstock

We may receive a commission on purchases made from links.

The FBI is asking organizations to update their web servers as soon as possible after two critical vulnerabilities were found in PHP, a programming language that powers a huge number of websites and web apps. The FBI's Cyber Division posted on X that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers remotely run code on servers using PHP and potentially compromise "sensitive data and networks."

Further, the agency also suggested that any organization unable to update right away should take its systems offline to help mitigate the potential risk. The fact that the FBI has even recommended such action should give you an idea of what kind of vulnerability is being dealt with here.…