Patch or go offline, say security agencies in the US, UK and Europe to companies as two critical bugs in…

Several security agencies across the world have sent out an alarming warning that two critical holes have been found in PHP. The critical bugs allow hackers to run code on almost any server running the PHP language.

For those unaware, PHP is a server-side programming language widely used for web applications. It is said to power roughly 70% of the websites on the internet.

Reports suggest that the details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches. Public reporting calls the vulnerabilities PHP2Shell, suggesting that attackers could exploit them to obtain shells on vulnerable servers.

Following the disclosure, government websites in several parts of Europe, UK and some in the US went offline. The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities.

Disruption was even more widespread in Finland, where state IT services provider Valtori said that the government public network services had been taken offline "as a precautionary measure." France's Interior Ministry said it had placed all of its websites into preventive maintenance. Here's what security agencies across the world are telling companies to do to protect their websites and businesses.

FBI to companies in America: Follow these steps right away The US National Security Agency told companies to patch immediately or pull vulnerable systems offline. The flaws "often provide a direct path to the server's file system or database," the NSA said in a statement.

Attackers could use them to take over web servers without needing a password. The Federal Bureau of Investigation (FBI) urged organizations to take the following steps now:* If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.* Immediately update affected PHP installations following the guidance on PHP webite.

Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.* Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.* If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office.

Those reports help us identify the actors involved and warn other organizations before they become victims. UK's National Cyber Security Centre (NCSC) to companies: Update to the latest version Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version.

Organisations using older versions of PHP are highly encouraged to update to a fully supported version. The NCSC recommends following vendor best practice advice in the mitigation of vulnerabilities.

The NCSC highly encourages organisations to follow these priority actions:* Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions; identify PHP installations generally and assess their exposure to CVE-2026-109618 and CVE-2026-109619.

Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP as a component. Apply relevant updates as they become available.* Update to the latest version of PHP and continue to monitor for future updates.* Apply the additional hardening steps provided by the PHP Team.* If you are unable to update to a version with the security update applied, the PHP Team have provided temporary mitigations.* If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.* If you are unable to update, or disable, the system immediately then you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker.

If you are not confident in your ability to do this yourselves then you can get assistance from an NCSC-assured Cyber Incident Response provider.* Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities.

European Union's CERT-EU to organisations: Patch affected assets immediately The EU's CERT-EU offered similar advice, telling operators to "consider isolating internet-facing applications from public networks until a fix can be applied" where remediation could not happen at once. In a release on its website, it says, "CERT-EU strongly recommends updating all affected PHP installations as soon as possible to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [4]."* Distribution packages: Linux distributions and LTS vendors received the patches in advance.

Check with your vendor for updated packages.* End-of-life versions (PHP 8.1 and older): Some distributions and LTS vendors provide backported fixes, so contact your vendor or upgrade to a supported version. Because of the severity, the PHP security team has also published minimal source backports for PHP 7.4, 8.0 and 8.1 for organisations that build from source or have no LTS vendor.rpms.remirepo.net users: This volunteer-maintained repository will not have updates on release day.

The PHP team urges users to switch to distribution packages or build from source.* Where immediate patching is not feasible, organisations should consider isolating internet-facing resources from public networks until the fix is applied and verified. You use AI every day.

Now get your AI Quotient.

Key quotes

• “as a precautionary measure.”

• “often provide a direct path to the server's file system or database,”

• “consider isolating internet-facing applications from public networks until a fix can be applied”

• “CERT-EU strongly recommends updating all affected PHP installations as soon as possible to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [4].”