NÚKIB warned of two critical vulnerabilities in PHP, labeled CVE-2026-109618 and CVE-2026-109619. According to the authority, these could allow attackers to remotely execute code on the vulnerable server without authentication, and information about their exploitation has already been publicly available. NÚKIB stated that fixes were released in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, and recommended immediate updates. An unusual indication of an exploitation attempt was marked by unusual processes triggered by PHP services. #PHP #bezpečnost #vulnerabilita (translated)
