Pronoy Chaudhuri

behavioral economics @harvard. data security and compliance @datadoghq. opinions are my own.

[Datadog, Inc. @datadoghq]

PHP has released fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0. If your organization runs PHP, now is a good time to check your versions.

Datadog Security Labs walks through how CVE-2026-109618 works. We’re still analyzing the findings and will update the blog post as we learn more.

https://t.co/VK8O4Y0wfw

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.