Today, attackers are targeting outdated PHP versions, which can allow them to execute malicious code. Small businesses using PHP should review their systems for vulnerabilities and apply security patches promptly.
PHP Group PHP (CVE-2026-109618)
PHP Group PHP. This product contains a memory corruption vulnerability that enables attackers to run arbitrary code without user interaction. Businesses should update their PHP installations to the latest version to protect against this risk.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
PHP Group PHP (CVE-2026-109619)
PHP Group PHP. This product has a stale internal request-state vulnerability that also allows attackers to execute code remotely. Businesses should ensure their PHP environment is secure by updating to the latest version available.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Use a password manager
One strong, different password for every site, kept in a password manager, means a leak at one site does not open all the others.
Doing it once, properly
The lowest quote rarely stays the lowest. Work that skips the security basics tends to be redone from scratch later, and redoing it costs more than doing it properly once.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-109618 on the National Vulnerability Database
- CVE-2026-109619 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.