On 21 October 2026, the NSA published an advisory concerning PHP. It urged organisations using the language to install updates addressing two critical vulnerabilities promptly. The advisory recommends taking systems offline until fully mitigated if they cannot be updated immediately.
The PHP project bulletin identifies CVE-2026-109618 and CVE-2026-109619, two flaws that may allow unauthenticated remote code execution. Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators using packages supplied by a distribution or extended-support provider should check that provider’s updates. PHP 8.1 and earlier no longer receive upstream security fixes.
The PHP project states that installing a patched version is the only complete fix; interim measures may reduce some attack paths without fully securing the system.
Why does this concern our research?
The vulnerabilities cited concern PHP. They do not establish that a Fondation UvH service uses an affected version; this note is not an audit of its infrastructure. They are a reminder that digital service security also depends on maintaining an inventory of software components and applying updates, alongside the assessment of artificial intelligence models.