WHAT’S HAPPENING
The PHP Foundation has identified two critical vulnerabilities in PHP, the programming language that powers a huge chunk of the internet (we’re talking potentially 70%+ of websites and web apps). If left unpatched, attackers could access sensitive data like passwords, authentication tokens, API keys, and certificates without even taking over the server. The FBI has already weighed in, calling for immediate action.
WHAT YOU NEED TO DO RIGHT NOW
Follow these four steps if you run websites, web applications, or uses third-party platforms:
- IDENTIFY: Determine if PHP is being used anywhere in their tech environment, including through third-party vendors. Ask your vendors too.
- PATCH: Apply the PHP update immediately. Patching instructions are available directly at PHP’s website (PHP: News Archive – 2026).
- TAKE OFFLINE IF NEEDED: If you can’t patch right away, the FBI and PHP Foundation are recommending you take the affected systems OFFLINE until it can be secured.
- MONITOR: Keep an eye on system logs for anything unusual or unexpected PHP processes, shell commands, or tools being downloaded.
Read the full HUB ProEx Cyber Alert here.
This update is provided by the HUB team.
