National Security Agency Urges Offline PHP Systems If Updates Aren’t Feasible
Photo: TokenPost
The National Security Agency (NSA) urged organizations unable to update affected PHP servers immediately to take them offline until mitigation is complete, after Cloudflare observed attack traffic targeting customers before Oct. 21 fixes. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can let attackers execute code remotely without authentication on affected web servers. One involves remote code execution through out-of-memory corruption; the other can leave stale internal state available between requests. Each received a 9.2 score under version 4.0 of the Common Vulnerability Scoring System (CVSS), placing both in the critical range.
Source: TokenPost
