The National Cyber Security Authority (AKSK) has urged institutions, businesses, organizations and system administrators to address two critical vulnerabilities in PHP, a technology widely used to run websites and web applications. If exploited, the flaws could allow attackers to execute code remotely without authorization, putting systems and sensitive data at risk.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involve how PHP manages memory and internal state while processing requests. Both carry a critical severity rating of 9.2 out of 10 under the CVSS v4.0 scoring system.

Security patches are now available. Therefore, administrators should check their current PHP versions and install the recommended updates. PHP versions 5.4 through 8.1 are also affected but no longer receive official updates from the PHP project.

AKSK recommends checking all PHP-based systems and applications immediately and installing updates from official sources or relevant providers. Administrators should also back up their data and monitor systems for suspicious activity.

Updating to a patched version remains the primary way to fully address these vulnerabilities. Meanwhile, temporary measures to limit exposure cannot replace a full security update.

AKSK has called on all organizations using PHP to prioritize these measures. The authority stressed that timely action is essential to reduce the risk of system breaches and protect digital data and services.