The National Cyber Emergency Response Team (NCERT) issued an urgent alert about two software flaws that could enable hackers to seize control of internet-facing web servers, steal data and disrupt services.
International media have reported that the vulnerability allows attackers to shut down government websites instantly.
The notice points to two critical bugs, CVE-2026-109618 and CVE-2026-109619, found in the PHP runtime used for many websites and web applications.
Both issues carry a severity rating of 9.2 out of 10.
Exploiters might compromise vulnerable systems without logging in or obtaining user consent. Security researchers have demonstrated exploits, and early malicious activity has been observed.
The advisory covers government portals, banks, e-commerce sites, web-hosting firms and any organization running publicly accessible PHP-based services.
If exploited, attackers could run commands on servers, install malware, steal credentials, access databases, alter site content or disrupt services. Platforms such as WordPress, Joomla, Drupal and Magento are also at risk if their underlying PHP runtime is vulnerable.
National CERT has instructed entities to identify affected PHP versions, apply official patches, limit unnecessary public exposure and watch for suspicious activity.
The notice also cautions against relying solely on website or plugin updates, because the flaws affect PHP itself; administrators may need a server-level update from hosting providers or OS vendors.
Organizations still using unsupported PHP releases, including PHP 8.1 and older, face added risk since upstream fixes are not expected. NCERT recommends moving to supported versions or isolating unpatchable systems.
Officials also urged monitoring for odd website requests, unexpected server processes, newly created PHP files and suspicious outbound connections that could signal an attack.
NCERT says suspected exploitation or compromised PHP-hosted services should be reported via its official incident portal or by contacting the agency.
The advisory calls on administrators to prioritize exposed systems, confirm updates are correctly applied and tighten monitoring to lower attack risk.
