PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code remotely on web servers. Versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 address the flaws, which received a critical CVSS v4.0 score of 9.2 out of 10, while minimal backports were released for PHP 7.4, 8.0 and 8.1. Cloudflare observed attacks targeting its customers, prompting Kraken and Ledger to urge operators to update PHP installations quickly and inspect routers, firewalls, network storage, administrative interfaces and vendor appliances that may embed the software. The UK National Cyber Security Centre also advised organizations to identify exposed installations, prioritize internet-facing systems and take them offline if patches cannot be applied promptly. The alerts report no breach at Kraken or Ledger, but coincide with Node.js security fixes and the compromise of eight internet authentication certificates.
Source: Read the original article
