Critical PHP Vulnerability: Do Critical Entities Know the Risks Facing Their Systems?

On 21 October 2026, the National Cyber Security Centre SK-CERT issued a warning about two critical PHP vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619. Both received a CVSS v4.0 rating of 9.2 out of 10. Under certain conditions, their exploitation may enable remote code execution without authentication.

PHP is used in the development of web applications and other information systems. If a vulnerable component is located in a system accessible to an attacker, the consequences may extend beyond the boundaries of the application itself. The specific impact depends on the configuration, permissions, and the interconnection of the affected system with other services.

The risk may also lie with the supplier

One of the practical challenges is maintaining an overview of technologies that the organisation does not directly manage. Web applications, cloud services, or external systems may contain software components whose versions and update status are unknown to the operator.

For critical entities, it is therefore not enough to review only their own IT infrastructure. They also need to know what technologies their suppliers use, who is responsible for updating them, and what procedure applies if a serious vulnerability is discovered.

If a compromised system is connected to other services, the incident may affect their availability or data security. In the case of critical infrastructure, cyber risk must therefore also be assessed in terms of the possible consequences for the provision of an essential service.

What should critical entities review?

In connection with the SK-CERT warning, organisations should in particular:

● determine whether they use PHP and which versions are affected by the vulnerability;

● also review applications and services operated by external suppliers;

● monitor the availability of security patches and ensure their deployment in line with the vendor's and SK-CERT's recommendations;

● where immediate updating is not possible, assess the risk and apply appropriate temporary protective measures;

● check security logs and investigate any signs of attempted exploitation.

The mere existence of a vulnerability does not yet mean that a system has been compromised. However, a security warning provides grounds for a targeted review and for adopting measures according to the specific risk.

Position of the Critical Infrastructure Association of the Slovak Republic

AKI SR President Tibor Straka comments on the significance of such warnings:

"In protecting critical infrastructure, it is important to know not only what we operate, but also what our operations depend on. At first glance, a software vulnerability may look like a purely technical problem. However, if it concerns a system on which the provision of an essential service depends, it becomes a question of that service's safe and reliable operation. This is also why security requirements must be part of supplier relationships, not just internal IT processes."

AKI SR draws attention to current security threats

The Critical Infrastructure Association of the Slovak Republic continuously draws attention to security risks that may affect critical entities and the provision of essential services. The purpose of such information is to present expert warnings also from the perspective of their practical significance for operators.

A technical warning is useful when it translates into a specific decision: to review the technologies in use, to contact a supplier, to update a vulnerable component, or to limit its exposure to risk.

Are organisations able to reliably determine which of their systems and supplier services may be affected by the current vulnerability? The answer to this question also shows whether they have the necessary overview of the technologies on which their operations depend.



AKI SR will continue to provide relevant information about threats and to highlight their possible consequences for critical infrastructure in Slovakia.