Pakistan's National CERT issues critical warning over PHP software vulnerabilities

The National Cyber Emergency Response Team (NCERT) issued a critical cybersecurity warning regarding two software vulnerabilities in the PHP runtime. Identified as CVE-2026-109618 and CVE-2026-109619, these flaws received a severity score of 9.2 out of 10.
Security researchers demonstrated that attackers could exploit these systems without logging in or obtaining user permission. Early malicious activity has already been reported involving websites running WordPress, Joomla, Drupal, and Magento.
The National CERT directed organisations to identify affected PHP versions and apply official security updates immediately. Officials warned against relying solely on website or plugin updates, noting that official upstream security fixes are not expected for PHP 8.1 and older releases.
Organisations are urged to report any suspected exploitation through the official incident reporting portal.







