This article was collected and archived by Digital Sovereignty Watch from an institutional or public source relevant to digital sovereignty, technology policy, cybersecurity, cloud services, artificial intelligence or European regulation.
Cybersecurity
Critical PHP Vulnerability: NCSA Calls for Immediate System Updates
The National Cybersecurity Authority (NCSA) is informing institutions, businesses, organizations, and system administrators about two critical vulnerabilities in PHP, a technology used to operate websites and web applications. Exploiting them could enable unauthorized remote code execution, putting systems and data at risk. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are related to how PHP manages memory and internal state while processing requests. Administrators should verify the versions in use and install the relevant patched versions. ⚠️ PHP versions 5.4 through 8.1 are also affected and do not receive official updates from the PHP project. NCSA recommends immediately checking the PHP versions used in systems and applications and installing updates from official sources or the relevant providers. NCSA urges all entities using PHP to prioritize implementing these measures to reduce the risk of system compromise and protect their digital data and services.