Pakistan’s National Cyber Emergency Response Team (National CERT) has warned of two critical software flaws that could allow hackers to take control of vulnerable websites and servers without logging in.
The warning comes as government websites in Europe were taken offline as a precaution after the flaws were discovered in PHP, a programming language used by nearly 70 percent of websites whose underlying technology can be identified.
Both vulnerabilities carry a severity rating of 9.2 out of 10. If exploited, they could allow attackers to run malicious commands on affected servers, steal sensitive information, change website content, or disrupt online services.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are also known collectively as PHP2Shell. They affect PHP itself, which powers popular website platforms such as WordPress, Joomla, Drupal, and Magento.
AI played a role in uncovering the flaws. Security researchers at Calif identified the first vulnerability with assistance from OpenAI’s GPT-5.6 Sol model, while researchers at Wiz independently discovered another flaw using AI tools.
The findings are particularly concerning because the vulnerabilities reportedly existed for years before researchers demonstrated how they could be exploited.
National CERT has warned that the risks extend beyond government websites to financial institutions, online stores, web hosting providers, and other organizations running publicly accessible PHP services.
A successful attack could give hackers access to a website’s underlying server. Depending on its configuration, this could expose customer information, database credentials, and other sensitive data. Attackers could also install malicious software or use a compromised server to target other systems.
The advisory also flags early malicious activity and publicly circulating demonstrations showing how the vulnerabilities could be exploited.
What Should Website Owners Do?
National CERT has urged organizations to identify affected systems, apply official security updates, restrict unnecessary public access, and monitor servers for suspicious activity.
The PHP security team has released fixes for supported versions. Administrators should install the appropriate updates through official PHP, operating system, or hosting provider channels.
Updating WordPress or its plugins alone may not resolve the problem because the flaws affect the underlying PHP software. Website owners using managed hosting should confirm that their providers have updated the server environment.
Organizations running older, unsupported PHP versions face additional risks and may need to migrate to supported releases or temporarily isolate exposed systems.
The warning highlights how a vulnerability in widely used software can put websites across different countries and industries at risk at the same time. Although not every website is affected, organizations running vulnerable versions need to act quickly to prevent potential attacks.
