انتقل إلى المحتوى الرئيسي
English
logo

NCSC-TAD-2610-002

مستوى الخطورة: حرجة
ثغرة

الرقم المرجعي: NCSC-TAD-2610-002CVSS 9.2

Critical PHP Vulnerabilities – Immediate Preparation Required

نوع التهديد:
غير متوفر
مستوى المشاركة (TLP):
CLEAR
CVE:
CVE-2026-109618, CVE-2026-109619

نظرة عامة

Bahrain National CERT would like to draw your attention to the two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, associated with a potential risk of unauthenticated remote code execution. Successful exploitation could compromise affected servers and their hosted applications.

The PHP security team has announced that both vulnerabilities are rated Critical (CVSS v4.0: 9.2). A security release is scheduled for 21 October 2026 at 5:00 PM Bahrain time (14:00 UTC). Detailed technical information, affected versions, and fixed versions are expected to be published with the release.

التقنيات المتأثرة

  • All PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12

إجراءات الحد من المخاطر والإجراءات الفورية

  1. 01

    Identify PHP deployments across your environment, including websites, applications, and services managed by third-party hosting providers.

  2. 02

    Prepare to apply the security updates immediately upon availability, prioritizing internet-facing systems.

  3. 03

    Coordinate with application owners and service providers to confirm responsibility for updating the underlying PHP runtime.

  4. 04

    Consider temporarily restricting public access or isolating potentially affected applications where timely patching is not feasible.

  5. 05

    Monitor relevant systems and logs for suspicious activity and report any suspected compromise to Bahrain National CERT through established reporting channels.

  6. 06

    Please share this advisory with your IT operations, application development, and security teams for urgent assessment and action.

المراجع