Critical flaws in ubiquitous website software draw urgent warning from NSA, FBI

US authorities warned organisations on October 21, 2026, to update PHP software after the disclosure of two critical vulnerabilities in the widely used web programming language. The NSA and FBI cautioned that successful exploitation could permit remote code execution, while national cyber agencies and European institutions urged administrators to apply security releases promptly. Emergency patches were issued that day, and several government and other websites were temporarily taken offline as a precaution during remediation. The flaws concern PHP installations and dependent applications rather than every website automatically being exploitable, making affected versions and configuration details important for defensive prioritisation.