Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

ok so I've been vibe coding a lot lately, mostly just learning and breaking stuff then PHP2Shell dropped yesterday, saw how bad it was and thought "wait, I can actually build something useful for this" so I did. took me like 4h 1/ it's called PHPeek, a tiny browser extension you open a site and the icon tells you if it's running a PHP version exposed to PHP2Shell: 🔴 likely exposed 🟢 patched 🟠 runs PHP but hides the version that's it. one glance 2/ made it fully open source bc a security tool you can't read is kinda sus lol it doesn't send anything anywhere, no tracking, no data. just reads headers your browser already has. <200 lines, go read them github.com/phpeek-ext/phpeek 3/ submitted to Firefox + Chrome Web Store tonight, both in review rn 🤞 not gonna pretend I'm some security expert, I just thought this was useful and wanted to ship it instead of sitting on it feedback, bugs, roasts all welcome 🫡