The National Cybersecurity Institute (INCIBE) has issued a critical-level alert after detecting two security vulnerabilities in PHP, a programming language widely used in the development of websites and applications.
These flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow cybercriminals to remotely execute malicious code without the need for authentication, compromising the security of servers and the information they manage. Both vulnerabilities have a severity rating of 9.2 out of 10, and attacks against affected servers have already been reported.
The issue affects various versions of PHP and servers using technologies such as Apache and PHP-FPM. In light of this situation, INCIBE recommends that organizations immediately update their systems to the patched versions, which are already available.
In cases where it is not possible to apply the updates immediately, it is advisable to implement temporary protective measures and, if necessary, isolate the affected systems from the Internet until the vulnerabilities are resolved.