New AI Flaw Lets Hackers Crash Govt Websites Instantly

Meanwhile, the National Cyber Emergency Response Team (NCERT) has issued a critical cybersecurity warning over two software vulnerabilities that could allow hackers to take control of internet-facing web servers, steal sensitive information, and disrupt online services.

Key points

• The advisory identifies two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP runtime, a technology applied to run websites and web applications.
• Both vulnerabilities have received a severity score of 9.2 out of 10.
• Organizations running unsupported PHP versions, including PHP 8.1 and older releases, face extra worries since official upstream security fixes are not anticipated for these versions.
• Attackers may be able to exploit vulnerable systems without logging in or obtaining user permission.
• Successful attacks could allow hackers to execute commands on servers, install malicious software, steal login credentials, access databases, change website content, or disrupt online services.

In practice, the advisory identifies two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP runtime, a technology applied to run websites and web applications.

Both vulnerabilities have received a severity score of 9.2 out of 10. NCCIA Problems Final Warning for Everyone.

Attackers may be able to exploit vulnerable systems without logging in or obtaining user permission. While early malicious activity was additionally noted, security researchers have reportedly demonstrated exploits.

In practice, the warning covers administration websites, financial institutions, e-commerce platforms, web hosting businesses, and other organizations running publicly accessible PHP-based services.

Successful attacks could allow hackers to execute commands on servers, install malicious software, steal login credentials, access databases, change website content, or disrupt online services. Websites running WordPress, Joomla, Drupal, and Magento could additionally be exposed if their underlying PHP runtime is vulnerable.

National CERT has directed organizations to identify affected PHP versions, prepare and apply official security updates, restrict unnecessary public access, and monitor servers for suspicious activity.

Notably, the advisory additionally warns organizations against relying only on website or plugin updates. Since the vulnerabilities affect PHP itself, administrators may need a separate server-level update through their hosting provider or operating system's trusted software channels.

Organizations running unsupported PHP versions, including PHP 8.1 and older releases, face extra worries since official upstream security fixes are not anticipated for these versions. National CERT recommends migrating to backed versions or isolating systems that cannot be secured.

In practice, the agency has additionally called on organizations to monitor unusual website requests, unexpected server processes, newly created PHP files, and suspicious outgoing network connections that could indicate an attempted or successful attack.

National CERT notes organizations should report suspected exploitation or compromised PHP-hosted services through its official incident reporting portal or by contacting the agency.

Meanwhile, the advisory urges administrators to prioritize exposed systems, verify that security updates have been applied correctly, and strengthen monitoring to reduce the risk of further attacks. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover. Follow on Google News Join WhatsApp. See more ProPakistani stories in Google Search and Top Stories.

For now, new AI Flaw Lets Hackers Crash Govt Websites Instantly remains the part of the story worth watching, and further updates are likely as more details are confirmed.