PHP Critical Flaws CVE-2026-109618/109619: Update Now

This week’s most urgent fix is not in a firewall or a VPN but in PHP, the language behind most small business websites, including almost every WordPress site. The data protection regulator also published a case that every firm with an outsourced IT provider should read, a remote support tool used by IT teams was attacked, and the NCSC told organisations to start moving to quantum-safe encryption.

PHP fixes two critical flaws that can hand over a web server

On 21 October PHP released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, and the NCSC told UK organisations to take immediate action the same day. Both can lead to remote code execution without a login. In the first, an attacker sends a request built to make PHP run out of memory part way through setting up, leaving memory in a corrupted state that can be exploited. PHP’s advisory says Apache’s mod_php is open to this before any website code has even run. In the second, leftover data from one visitor’s request survives into the next request handled by the same worker.

The NCSC says organisations using any version of PHP are affected, so do not assume an old site is safe or a new one is fine. Ask whoever hosts your website, or the agency that built it, which PHP version it runs and when it will be on one of the four fixed releases; on shared hosting the provider normally updates PHP, but sites pinned to an older version may not be covered. The NCSC advises taking a system offline if it cannot be updated or given PHP’s temporary mitigations quickly, and checking for signs of compromise on anything left exposed. PHP also sits inside other products, so watch for updates from suppliers of appliances and web apps, too. Under Cyber Essentials critical fixes are due within 14 days; our patch deadline calculator works out the date. Sources: the NCSC alert and PHP’s advisories for CVE-2026-109618 and CVE-2026-109619.

“Password1 is not an appropriate password”: the ICO reprimands two Welsh bodies

On 20 October the ICO reprimanded Ogi Networks Limited and the Local Government Data Unit, Wales (Data Cymru) after a ransomware attack on 1 November 2024 exposed the personal information of 3,300 people, most of them children. The attackers got in through a test account called “Test2” that Ogi Networks had created in January 2012 and that still had the password “Password1” more than 12 years later. The attack encrypted 182.7GB of data and 42GB was taken from Data Cymru’s systems.

The finding that matters for small firms is the split of blame. Ogi Networks created the account, but Data Cymru controlled the network and had no compliant contract with Ogi Networks as a sub-processor, and neither side routinely reviewed old accounts. The ICO’s list of lessons is short: strong passwords, multi-factor authentication on remote access, regular reviews of every user account, and clarity about who is responsible for security when IT is outsourced. If your IT provider set up accounts on your network, ask for a list of them. Our password crack time calculator shows why “Password1” fails, and our pages on data processing agreements and managed cyber security services cover the contract side. Read the ICO announcement.

BeyondTrust Remote Support flaw is being exploited

BeyondTrust published advisory BT26-05 on 15 October for CVE-2026-102764, a critical flaw in its Remote Support product, the tool many IT teams and support firms use to take control of staff computers. It scores 9.3 out of 10 and lets a remote attacker carry out file operations on the appliance, because an internal messaging component did not check where messages came from. All versions are affected. BeyondTrust says cloud customers were patched on 9 October; self-hosted customers not on automatic updates must apply the patch themselves, and anyone on a version older than 24.3.1 has to upgrade first. CISA added it to its list of exploited flaws on 16 October.

A remote support tool is a master key to every machine it manages, which is why attackers target it. If an IT provider supports your business remotely, ask which tool it uses and, if it is BeyondTrust and self-hosted, whether the BT26-05 patch is on. CISA also listed two other exploited flaws that week: CVE-2025-61624 in Fortinet’s FortiOS and related products, which needs an admin login, on 16 October, and CVE-2026-21589 in Atlassian’s self-hosted Data Center products such as Jira and Confluence, which lets an attacker with no login read certain files, on 15 October. Our page on endpoint security management covers the controls insurers ask about here. Sources: BeyondTrust and CISA’s catalogue.

The NCSC says it is time to move to quantum-safe encryption

On 15 October the NCSC updated its guidance on using TLS, the encryption behind every padlock in a browser, to include recommended settings for post-quantum cryptography. It recommends both hybrid settings, which combine a quantum-safe method with a traditional one and are the most widely supported, and pure post-quantum options. The catch is that only TLS 1.3 supports post-quantum cryptography; earlier versions will not be upgraded. The NCSC wants high-priority migration done by 2031 and says many organisations should be making this move now.

For most small firms this is a question for suppliers, not a project. Ask your web host, email provider and VPN supplier whether their services support TLS 1.3, and treat anything still relying on TLS 1.2 or older as due for replacement. It is a fair question to add to a cyber security audit. Read the NCSC blog post.

Also this week

On 12 October the government said it would extend two pilots using frontier AI to defend government systems, which have already helped find and fix more than 1,000 potential vulnerabilities. It will also look at strengthening the Cyber Security and Resilience Bill so that essential services are better protected from AI-related risks, including how serious AI incidents and near misses are reported. Details are on GOV.UK.