The Sudeten lawyer stated that the NUKIB sent him a notification about the security incidents CVE-2026-109618 and CVE-106619 today at 19:17:49. He claimed that the critically serious bug affecting a large number of web servers had been known since the previous day, when the publication was scheduled for today at 14:00 UTC, or 16:00 CET, so that administrators could prepare and install the patch. According to him, administrators in small companies were aware of the bug if they monitored security groups or the PHP web. He also stated that Dutch authorities began shutting down their websites before the publication due to concerns about attacks in the time before the release and installation of the patch; similarly, he claimed that other services, including 4chan, took similar actions. The lawyer criticized that NUKIB sent the notification via email more than three hours later, by which time attacks were already happening, according to him. He described the text of the report as technically inadequate and criticized it for confusing the programming language and the interpreter. He stated that he did not believe the bug was in the PHP programming language and questioned the work of NUKIB. #bezpečnost #chyby #ITsecurity (translated)