The Jakarta Post
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search results
Popular Reads
Top Results
No results found. Please check your search term and try again
Can't find what you're looking for?
View all search resultsCybersecurity agency urges stronger defenses as AI exposes new vulnerabilities
Government agencies and major organizations in the US, UK, EU, Singapore and Japan have been treating PHP2Shell as a global cybersecurity emergency and have taken websites completely offline as a precaution while applying security fixes.
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
A person types on a laptop in this undated illustration of a malware attack. (Shutterstock/TippaPatt)
T
he National Cyber and Encryption Agency (BSSN) has urged website operators to patch critical vulnerabilities in the PHP programming language and isolate exposed systems until they can be secured, as organizations worldwide scramble to protect themselves from potential cyberattacks.
The warning follows an international security alert after artificial intelligence agents uncovered critical flaws in a programming language which powers much of the internet.
In a security advisory published on its website on Thursday, BSSN outlined mitigation measures for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
The flaws are particularly dangerous because it could allow remote attackers to execute malicious code on vulnerable servers without authentication, potentially exposing sensitive information and compromising websites.
Read also: Websites go dark as AI exposes critical security flaws
The first, CVE-2026-109618, can cause memory corruption when PHP runs out of memory while processing website requests. The second, CVE-2026-109619, occurs when PHP tries to use a piece of computer memory that has already been released, potentially disrupting the program’s operation.
Both flaws could give potential hackers a way to run their own commands on affected servers, potentially compromising websites and the systems behind them.
