Cybersecurity alert identifies PHP vulnerabilities

A cybersecurity alert issued by the CERT-FR on October 21, 2026, highlights two critical vulnerabilities in PHP, a widely used component for running websites and online applications. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to execute their own instructions on a vulnerable server without needing an account on the targeted service. Patches for these vulnerabilities were released on the same day.

European authorities urged to address vulnerabilities

The alert has prompted European authorities to prioritize identifying and correcting systems that use the vulnerable PHP versions. Companies are advised to check all services accessible on the Internet, including websites, online stores, customer areas, distributor order portals, partner applications, and APIs, to determine which use the vulnerable PHP and which can be corrected.

Consequences of exploitation vary

The consequences of a successful attack depend on what the compromised program is allowed to read or modify. These stakes can range from an unavailable website to access to the information it processes. The presence of PHP does not prove an intrusion or a persistent vulnerability if the patch has already been applied.

Companies must coordinate with multiple providers

Companies may have multiple service providers managing different aspects of their online presence, such as website agencies, hosting companies, and maintenance teams. Each provider may have partial knowledge of the installation, and the CEO must obtain precise answers regarding who administers PHP, what corrections have been applied, on what date, and who verified that the application actually uses the corrected version.

PHP vulnerabilities affect more than just websites

The alert also extends beyond websites to equipment and internal applications. PHP can run the administration interfaces of certain equipment, including video surveillance tools, building or factory technical management applications, network equipment, and maintenance portals. The manufacturer or integrator must confirm the case for each installation.

Suppliers may not fully resolve the issue

In some cases, an online service update from the supplier may not correct the software installed in the company's premises. A response must be obtained for this specific installation, distinguishing a temporary protective measure from the complete PHP correction.

Security checks and response procedures

The British NCSC recommends searching for signs of compromise and persistent access, with the help of a specialized service provider if necessary. This search must be organized with the corrections, preserving useful traces. In case of suspicion, specialists must determine what was accessible, isolate the affected systems, and verify the conditions for a safe resumption.

Legal considerations for data breaches

If personal data is involved in a breach, the legal department and the data protection officer must assess the notification obligations. The GDPR provides for notification to the competent authority as soon as possible and, if possible, within 72 hours of becoming aware of it, unless the breach is not likely to pose a risk to the rights and freedoms of individuals. The CNIL details this procedure.