The Australian Signals Directorate has put Australian government agencies and businesses on high alert over an unpatched security hole in the almost endemic web scripting language PHP that jumped the fence into the wild before a fix was released.
The top-level alarm was rung on Wednesday afternoon, with ASD saying that “PHP Foundation has published advanced notice of critical vulnerabilities; organisations are recommended to monitor for the release of relevant patches to address these vulnerabilities”.
“The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) is aware of related media reporting which identifies these vulnerabilities as CVE-2026-109618 and CVE-2026-109619, though no official technical details have been publicly released at this time,” ASD said, adding it “understands that all PHP versions from PHP 5 onwards may be affected.”