NSA Tells Website Owners to Update Immediately or Shut Down Their Sites

Notably, the US National Security Agency (NSA) has issued an urgent warning over two critical security vulnerabilities in PHP, a programming language applied by approximately 70% of websites worldwide.

Key points

• Security researchers identified two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
• The patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Separately, Google's Wiz security team applied its Wiz Atlas AI agent, Gemini 4 Argon, and GPT-5.6 Sol to identify multiple PHP vulnerabilities.
• The PHP Foundation published security updates on October 21, 2026, addressing both vulnerabilities.
• Cybersecurity firm Calif discovered one of the critical flaws using OpenAI's GPT-5.6 Sol model through the company's Patch the Planet initiative.

Meanwhile, the vulnerabilities could allow hackers to remotely take control of affected web servers, access sensitive information, and compromise databases without needing login credentials.

Meanwhile, the NSA cautioned on Wednesday, October 21, that organizations must immediately update their PHP installations. It additionally recommended taking vulnerable websites offline if security patches cannot be applied promptly. Pakistan Among Most Targeted Countries in Israeli Spyware Campaign. Millions of Websites at Risk.

PHP is widely applied to build websites and web applications, including popular content management systems such as WordPress, Drupal, and Joomla.

Meanwhile, the flaws affect how PHP manages memory and handles errors. Under certain conditions, attackers can exploit them to run malicious code on servers without authentication.

According to security firm Wiz, the underlying matters have existed in PHP versions dating back to PHP 5.4, published more than a decade ago.

As exposure depends on the installed version and server configuration, nevertheless, not every website using PHP is necessarily vulnerable.

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely applied for web applications. These vulnerabilities often provide a direct path to the server's file system or. NSA Cyber (@NSACyber) October 21, 2026. AI Supported Discover the Flaws. Artificial intelligence played a major role in identifying the vulnerabilities.

Both teams worked with PHP developers to investigate the problems, develop security fixes, and test the patches before publicly disclosing their findings.

Other technology firms, including Cloudflare, AWS, Akamai, Microsoft, Automattic, Fastly, and Vercel, additionally assisted with security preparations.

Meanwhile, the PHP Foundation published security updates on October 21, 2026, addressing both vulnerabilities.

Notably, the patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Website administrators should upgrade to the latest patched release available for their backed PHP version. Older, unsupported installations may require a more extensive upgrade.

Notably, the NSA additionally advised organizations to identify vulnerable systems, strengthen security monitoring, and temporarily disconnect affected services if immediate patching is impossible.

WordPress clarified that the vulnerabilities are not specific to its platform. Website owners must update their PHP installations, often through their hosting providers, to address the underlying security challenges. New AI Flaw Lets Hackers Crash Govt Websites Instantly. AI Raises New Security Reservations.

OpenAI remarked researchers identified the vulnerabilities before attackers were known to have exploited them.

Nevertheless, security experts cautioned that AI could additionally produce these flaws easier for hackers to exploit.

Wiz explained that AI models can support attackers adapt malicious code to different PHP versions, server configurations, and memory layouts, reducing the technical expertise previously required.

Although researchers had not confirmed widespread exploitation at the time of disclosure, technical details and early proof-of-concept attacks had begun circulating publicly.

Security agencies are therefore urging website operators to apply the available patches immediately to prevent potential attacks. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover. Follow on Google News Join WhatsApp. See more ProPakistani stories in Google Search and Top Stories.

Technology and Automotive Specialist covering the latest cars, smartphones, AI breakthroughs, and.

In short, NSA Tells Website Owners to Update Immediately or Shut Down Their Sites is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.