Multiple websites go offline after critical PHP security flaw; FBI urges immediate updates. Here's what you should do

Multiple websites across the anime, gaming and online forum communities have reportedly gone offline for emergency maintenance after two critical vulnerabilities were identified in PHP, a programming language used to power websites and web applications.

The US Federal Bureau of Investigation (FBI) has urged organisations to immediately update affected PHP installations or take vulnerable systems offline until the security issues are fully addressed.

"Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks," the FBI's Cyber Division warned in a statement.


The agency advised organisations to follow the security guidance published on the official PHP website and identify all systems running the software, prioritising internet-facing servers and third-party products that include PHP.

"Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation," the FBI said.

It also urged organisations that detect signs of a breach to isolate affected systems, preserve web server and PHP logs, and report the incident to their local FBI field office or the Internet Crime Complaint Center (IC3).

"Those reports help us identify the actors involved and warn other organizations before they become victims," the agency added.

Which websites have gone offline?

Reports indicate that several websites associated with anime, gaming and online communities have been taken offline or placed under emergency maintenance as administrators respond to the PHP vulnerabilities.

Anime Updates, an account that tracks anime-related news, claimed in a post on X that website operators were scrambling to address the issue.

"From 4chan (partial) to Kmanga, Aimer to Nintendo (partial), Uma Musume to Bandai Namco, multiple wiki pages, etc., site owners scrambling in full force," the account said.

How dangerous are the PHP vulnerabilities?

According to cybersecurity company Huntress, the vulnerabilities could allow malicious actors to steal information or launch cyberattacks targeting visitors to compromised websites.

The risk stems from PHP's widespread use in website development. The software is used by popular content management systems and e-commerce platforms, including WordPress, Drupal, Joomla and Magento.

A successful remote code execution attack can allow an attacker to run unauthorised commands on a vulnerable server. Depending on the system's configuration and the attacker's level of access, this could lead to data theft, further compromise of the server or attacks on connected systems.

Internet infrastructure company Cloudflare also reported seeing attack attempts before the PHP Foundation released fixes for the vulnerabilities.

"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Cloudflare CTO Dane Knecht said in a post on X.

PHP Foundation warns of a shortage of security experts

The incident has also drawn attention to the resources available to maintain PHP, which is used by a large number of websites worldwide.

The PHP Foundation warned that its security work depends on a relatively small group of developers, supported by some volunteers, even as the number and complexity of security threats increase.

"Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing," the foundation said in a blog post.

It added that automated tools cannot replace experienced engineers when it comes to deciding how to fix longstanding design issues, evaluating compatibility trade-offs and reviewing patches.

"Making those decisions takes experienced engineers who know the entire PHP codebase and today there are too few of them," the foundation said.

What is PHP and why does it matter?

PHP stands for PHP: Hypertext Preprocessor. It is an open-source, server-side scripting language widely used to build websites and web applications.

According to educational computing website W3Schools, PHP can generate dynamic webpage content, process form submissions, manage files on servers, handle cookies, interact with databases and encrypt data.

Because PHP runs on servers, vulnerabilities in its core can potentially affect the websites and services that depend on it. The consequences of an exploit will depend on the vulnerability, the PHP version, the server configuration and the security measures in place.

What should internet users and website owners do?

Till a fix is found for the bug, users should remain alert to suspicious websites and messages. The vulnerabilities do not automatically mean that every website running PHP is compromised, but unpatched systems may face increased risks.

• Stick to trusted websites: Avoid unfamiliar links and websites that display unexpected warnings or suspicious behaviour.
• Watch out for phishing attempts: Be cautious of unexpected emails, text messages and social media messages claiming to come from services you regularly use.
• Enable two-factor authentication: Add an extra layer of security to important accounts, particularly email and banking.
• Keep software updated: Install the latest security updates for your operating system, browser and other applications.
• Heed browser warnings: If your browser flags a website as a security risk, do not bypass the warning without verifying that the site is safe.

For website owners and administrators:

• Apply security patches immediately: Follow the official PHP security guidance and install the appropriate fixed version.
• Identify vulnerable systems: Check all servers, applications and third-party products that use PHP, especially those exposed to the internet.
• Monitor for suspicious activity: Look for unexpected command-shell launches, unauthorised downloads and other unusual server processes.
• Investigate possible breaches: Isolate affected systems, preserve logs and report suspected cybercrime to the appropriate authorities.

Website owners who rely on managed hosting should contact their hosting provider or check their hosting control panel to confirm that affected PHP installations have been updated.

With reports of early attack attempts emerging, administrators should prioritise remediation and investigate suspicious activity rather than assuming that installing a patch alone rules out a previous compromise.