The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately. If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

The FBI and other partners disrupted a cryptocurrency exchange named E-Note. Cyber criminals used this service to launder millions of dollars from their illicit activity. Read more about this law enforcement action and indictment of E-Note’s operator: justice.gov/usao-edmi/pr/fbi…

Current and Former National Basketball Association Players and Four Other Individuals Charged in Widespread Sports Betting and Money Laundering Conspiracy fbi.gov/news/press-releases/…

Today, the DOJ announced a multinational operation to take down the infrastructure of the online cybercrime marketplaces known as Cracked and Nulled, and charges were unsealed against an administrator. Learn about the FBI’s investigation here: justice.gov/opa/pr/cracked-a…

In today’s world, digital and real lives blend, making us vulnerable to cybercriminals who can disrupt both. This #CybersecurityAwarenessMonth, learn how to protect yourself from threats that can impact every aspect of your life: fbi.gov/investigate/cyber#Wh….

On this solemn anniversary, the #FBI joins the nation in remembering the victims who lost their lives as a result of the 9/11 terror attacks. We also honor the courageous people who contributed to the response, recovery, and investigation in the aftermath. #NeverForget.