Indian web administrators have been urged to review every PHP-based system
The US National Security Agency (NSA) has issued an urgent cybersecurity warning about PHP2Shell, a set of critical vulnerabilities in the PHP programming language that could let attackers take complete control of a web server without even logging in. The agency’s advice is blunt: patch immediately, and if that isn’t possible, take the affected system offline.
Emergency update released
PHP rolled out an emergency security update on October 21, soon after the problem came to light. The NSA has asked organisations to check every system that uses PHP and apply the patch without delay. A server that cannot be secured right away should be disconnected from the internet, particularly if it holds sensitive data, until it can be fixed.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
— NSA Cyber (@NSACyber) October 21, 2026
Why PHP2Shell is especially dangerous
The flaw does not lie in a website’s own code. It is in PHP itself, so any system running the affected PHP versions can be hit, even if the application running on top is perfectly sound.
Once attackers are in, they can run their own commands, steal confidential information, disrupt services, plant malware or move deeper into the network. That puts data, services and business operations at risk.
What the NSA wants organisations to do
The agency expects cybercriminals to actively go after these vulnerabilities, and US government agencies are patching their systems as quickly as possible. It has set out these steps:
- Identify the hardware, software and public-facing systems that use the vulnerable PHP versions.
- Install the latest security patches, both from PHP and from any other vendors whose products rely on PHP, and watch for further patches from those vendors.
- Step up network and operations logging so suspicious activity can be spotted early and attacks can be traced.
- Begin planning to replace outdated or unsupported PHP systems that cannot be patched.
Older, unsupported releases will not get a fix, so those systems will need to be upgraded to a supported version. Before installing a patch, organisations should also make sure it matches their PHP version and setup.
A warning for India too
The advisory is not only meant for US businesses. Indian organisations are being urged to treat it as a wake-up call. Web administrators and IT teams should review every PHP-based system, find out which versions they run, check whether they are vulnerable and begin patching. If patching isn’t possible, the affected systems should be isolated or shut down for now.
The NSA said it is working with cybersecurity experts and agencies such as CISA to keep government and national security systems protected, but stressed that this is a problem for everyone. PHP powers a large part of the web, which is why quick updates and constant monitoring matter.
For all the latest updates, download PGurus App.
- US NSA issues urgent PHP2Shell warning: patch now, or take unpatched servers offline - October 22, 2026
- Indian Navy begins Rafale-M take-off and landing trials in Goa ahead of INS Vikrant operations - October 22, 2026
- Two Killed, Indian Among Injured as Drone Debris Hits Aramco’s Shaybah Oilfield - October 22, 2026
