Following the advisory released by the National Security Agency (NSA) regarding a critical vulnerability in background web software (PHP), here are some things you need to know.
For MOREnet-hosted Websites
Our team went into immediate action. Please know that all websites hosted by MOREnet have been updated to a version of PHP that is patched for CVEs 2026-109618 and 2026-109619. You do not need to take any action for the website we host for you.
For Servers or Applications Managed on Your End
If your organization runs or manages your own independent web servers, applications or secondary hosting environments using PHP, the Cybersecurity and Infrastructure Security Agency (CISA) urges organizations to take the following actions.
- Identify and inventory systems running any version of PHP across your organization.
- PHP is often a component of other software and prevalence may not be directly observable.
- Apply the patch immediately, prioritizing internet-facing systems.
- Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
- A web application firewall may provide some protection until systems are updated or patched.
- Review the official PHP security advisory for guidance on patching.
- Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.
If your website is hosted by a third party, we recommend you check with the hosting organization to ensure PHP is patched. After any patch or update, verify your site’s functionality. We will continue to closely monitor for any further updates or official guidance and will share additional information as it becomes available.