Cyber ·
Critical PHP vulnerability (CVE-2026-109618, CVE-2026-109619) and yellow infoCon
SANS ISC raised its infoCon to yellow after PHP announced a critical update for two CVEs, with a CVSS of 9.4 and preliminary PoC exploits available before the patch.
Radar, October 21 (Wednesday). PHP.net announced it would release a critical update the same day for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. SANS ISC changed the infoCon to yellow for three reasons stated in the source: widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of preliminary PoC exploits before the patch was available. The source does not detail affected versions or attack vectors; consult the original record for those. For organizations running PHP, the practical step is to identify the versions in use and apply the update once published. Rota Nacional does not patch server software, so this advisory has no direct connection to the platform. If you use AI to study the advisory, remove server names, paths, keys, logs and any personal data before sending the text. The platform's barrier detects CPF, CNPJ, e-mail, phone and names, but it does not identify infrastructure secrets. To verify, consult the original SANS ISC diary entry and the PHP.net release notes through the links in the source feed, and check the CVE identifiers in the official records.