₦airaland Forum

NSA Cyber issues warning:

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

Source

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

FBI Cyber Division

More issues for nose grabbing scammers. These ones in Nigeria will still meet up.

Correct country that cares

You nor see wisdom!
They didn't disclose the vulnerabilities, because in doing so, people go hack things 😅 - but it's also possible that the vulnerabilities are already flying around on the dark web.

Incase you're thinking that "I don't have php application" - your WordPress website runs on PHP. So update from your control panel, or take your site down - especially if you run critical application for a serious business.

That's on period. I hope they adhere to avoid stories.

Session token should be able to mitigate such risks .

Issuing directives as if they're the one that discovered the vulnerability.

Stephen0mozzy:
You nor see wisdom!
They didn't disclose the vulnerabilities, because in doing so, people go hack things 😅 - but it's also possible that the vulnerabilities are already flying around on the dark web.

Incase you're thinking that "I don't have php application" - your WordPress website runs on PHP. So update from your control panel, or take your site down - especially if you run critical application for a serious business.

PHP 8.5 has been there for some months. If there is any update to be made someday hosting side

integrity16:
Correct country that cares

Not just cares, but KNOWS.

Does anyone in our NSA office know what PHP is let alone care about cyber security?

In Tinubu's Nigeria, there are too many square pegs in round holes.

How are you so sure that this so-called patch won't allow them to get the access they are telling you people will get if you don't update? Could this reserve psychology speaking? You update, and you give them the key to your database?

dalitigator:
How are you so sure that this so-called patch won't allow them to get the access they are telling you people will get if you don't update? Could this reserve psychology speaking? You update, and you give them the key to your database?

Updates and patches are standard practice globally.

NaijaNaWaa:
Not just cares, but KNOWS.

Does anyone in our NSA office know what PHP is let alone care about cyber security?

In Tinubu's Nigeria, there are too many square pegs in round holes.

You reason like chicken

BigCowHornn:
PHP 8.5 has been there for some months. If there is any update to be made someday hosting side

There's a patch. I just looked it up (8.5.12) and other versions that have the vulnerability, also have a patch.

dalitigator:
How are you so sure that this so-called patch won't allow them to get the access they are telling you people will get if you don't update? Could this reserve psychology speaking? You update, and you give them the key to your database?

Popular and widely used Open Source tools like PHP are not maintained by any jack that will put backdoors in patches.

Bola Tinubu sent the advice to Donald Trump.

Luckily, he listened... If not

I use node.js for everything backend and database management

nlfpmod:
NSA Cyber issues warning:



Source



FBI Cyber Division

NaijaNaWaa:
Not just cares, but KNOWS.

Does anyone in our NSA office know what PHP is let alone care about cyber security?

In Tinubu's Nigeria, there are too many square pegs in round holes.

What's wrong with you? 😂 😂 😂
Why are you like this nah 😆

boxypane:
More issues for nose grabbing scammers. These ones in Nigeria will still meet up.

You don’t even know what is going on .
Maybe they have close the backdoor they are using to spy on people.

Isn’t this a CVE for PHP 8.2? Not sure it affects all versions of PHP. Might be wrong though

Na china get PHP?!

As a PHP programmer, find out why.

sigmax:
Session token should be able to mitigate such risks .

No, it can't.

Authentication (that is session tokens, login pages) can only stop unauthorized users. It does not stop processing of malicious payload that occurs during initial request parsing, which is the issue being addressed here. If your version is vulnerable you must patch it, simple!

I have been using PHP for years and continue using it, the first rule is in how you right your scripts/code for web apps Make sure you also do url rewriting do not also forget your post/get session script avoid using CMS and frameworks, you will be fine!

I didn't know PHP is still that relevant

Let create a WhatsApp group for ai vibe coders

NaijaNaWaa:
Not just cares, but KNOWS.

Does anyone in our NSA office know what PHP is let alone care about cyber security?

In Tinubu's Nigeria, there are too many square pegs in round holes.

I dislike this when people downgrade the country at any slightest opportunity.

Who told you that those in NSA doesn't know about PHP?

Do you think to be NSA director na beans?

Well, you talk small truth sha.

dalitigator:
How are you so sure that this so-called patch won't allow them to get the access they are telling you people will get if you don't update? Could this reserve psychology speaking? You update, and you give them the key to your database?

Others can also see the update and determine its safety.

Nairaland also runs on PHP

Stephen0mozzy:
There's a patch. I just looked it up (8.5.12) and other versions that have the vulnerability, also have a patch.

Thank you so much for the update

Stylishly telling Nigerians that the cyber space is not secured, so anything fit happen to their votes. Another technical glitch loading

Stephen0mozzy:
Popular and widely used Open Source tools like PHP are not maintained by any jack that will put backdoors in patches.

But somehow, there's a vulnerability. You're a learner.