Find. Prioritize. Fix. Verify.

October 21, 2026. 2-minute read.

An attacker may not need a password—or even reach your application’s login page.

On October 21, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, announced with severity scores of 9.2 out of 10.

They can allow attackers to execute code remotely without authentication.

For one affected configuration, PHP reports a demonstrated attack that triggers before application code runs.

Nearly 7 in 10 websites with a known server-side language use PHP.

In plain language: 70% of websites worldwide may be affected and application’s login controls may never get a chance to help.

PHP urges immediate updates.

Temporary measures can reduce specific attack paths, but an update is the only complete solution.

This is the latest critical vulnerability.

It will not be the last.

The next one may affect a firewall, a cloud service, an operating system, or a component buried inside a business application.

Why this matters

You cannot prevent every software flaw. You can reduce how long your enterprise remains exposed and how far an attacker can get.

That requires a repeatable process:

Identify: Know what you run, where it is exposed, which business services depend on it, and who owns it.
Prioritize: Combine technical severity with exploitability, internet exposure, sensitive data, and business impact. A severity score alone cannot tell you what to fix first.
Fix: Assign an owner and deadline. Patch or upgrade, reduce unnecessary access, and apply appropriate temporary controls when remediation cannot happen immediately.
Verify: Confirm the fix reached the running systems, test the application, and check that deployment images will not reintroduce the flaw.

This is where Exposure Management comes in.

This cybersecurity category connects asset discovery, vulnerabilities, misconfigurations, threat intelligence, and the paths attackers could use to reach critical systems. It helps teams prioritize action and validate whether exposure has actually been reduced.

Examples across the market include Microsoft Security Exposure Management, Check Point Software Exposure Management, CrowdStrike Falcon Exposure Management, Tenable One, TrendAI Vision One Cyber Risk Exposure Management, and Palo Alto Networks Cortex Exposure Management.

Their coverage, integrations, and remediation capabilities differ.

My takeawayTreat today’s PHP advisory as an urgent remediation task, and a test of your readiness for tomorrow’s vulnerability.

A dashboard full of findings is not the outcome.

Find. Prioritize. Fix. Verify. Repeat.

How quickly could your team identify every affected business service and prove the fix is in production?

Sources

PHP security advisory: lnkd.in/eW8rZ8dj
W3Techs usage statistics: lnkd.in/eBUvMh7K

Originally posted on LinkedIn

Mariano O'Kon speaks and advises on AI, cybersecurity, networking, infrastructure and the business impact of technology. Full bio