Critical PHP vulnerabilities in 2026: why should businesses check the security of their IT systems without delay?

The critical PHP vulnerabilities disclosed on 21 October 2026 triggered extensive preventive security measures in Latvia and elsewhere in the world. Access to several government digital services was restricted, while cybersecurity experts urged businesses to apply software updates without delay. These events show once again that IT system security, regular software updates and data protection are essential to every company’s business continuity.

PHP is one of the most widely used server-side programming languages in the world. It powers not only websites and online shops but also many companies’ internal systems, customer portals, CRM, ERP and other business solutions.

On 21 October 2026, the PHP developers released emergency security updates to fix two critical vulnerabilities:

• CVE-2026-109618
• CVE-2026-109619

Both vulnerabilities were rated 9.2 out of 10 on the CVSS v4.0 scale, indicating a particularly high security risk.

Under certain conditions, these vulnerabilities may allow attackers to remotely execute malicious code on a server without user authentication.

This means the threat can affect not only publicly accessible websites but also the information systems, databases and business processes connected to them.

The vulnerabilities affect PHP installations that handle web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed environments.

It is important to understand that using PHP does not in itself mean a system has already been compromised. However, running vulnerable software creates a serious risk if the necessary security fixes are not applied in time.

In response to international cybersecurity warnings, a decision was taken in Latvia on 21 October to temporarily restrict access from abroad to a number of government digital resources. This was announced by CERT.LV, Latvia’s cybersecurity incident response institution.

These restrictions were introduced as a precaution to reduce the risk of possible cyberattacks and to give system maintainers the opportunity to apply the necessary updates safely.

According to information published by CERT.LV, the access restrictions could remain in place until 26 October, depending on progress with the rollout of updates.

In its update of 21 October 2026 at 23:00 Latvian time, CERT.LV reported that automated attempts to exploit the PHP vulnerabilities had already been detected in Latvia, but no successful attacks had been reported at that point.

This situation clearly demonstrates the importance of preventive cybersecurity. When a security risk is known, it needs to be addressed before an incident, not after the company has already suffered data loss or a disruption to its operations.

The situation was not limited to Latvia. On 21 October 2026, the Dutch government announced the temporary suspension of several government digital services as a precaution, among them Overheid.nl, MijnOverheid.nl and DigiD.

The European Patent Office (EPO), for its part, temporarily took its website and several online portals offline. Once the necessary security fixes had been applied, the services were gradually restored.

A joint warning was also issued by the European Commission, the European Union Agency for Cybersecurity ENISA, CERT-EU, Europol and the cybersecurity incident response teams of the EU member states.

Organisations were urged to immediately identify systems running in a PHP environment, check internet-facing solutions as a priority and apply the published security updates.

These examples show how much the availability of digital services depends on software security and timely system maintenance.

In many companies, IT systems are closely tied to day-to-day work. They process customer data, orders, invoices, financial information and documents, and support internal business processes. A company may be using PHP technology without even realising it.

It may be part of:

• the company website or online shop;
• CRM and ERP systems;
• a customer or partner portal;
• a warehouse and order management system;
• an internal administration platform;
• a booking, payment or document management solution.

If such systems are not regularly maintained and updated, their vulnerabilities can become an entry point for cyberattacks.

Leaks of confidential information

In the event of unauthorised access, customers’ personal data, contact details, transaction history, financial documents or the company’s trade secrets may be put at risk.

Business disruption

If a cyberattack makes a system unavailable, the company may lose the ability to accept orders, process payments or serve its customers.

Financial losses

Dealing with the incident, restoring systems, recovering data and operational downtime can lead to significant costs. In some cases, the losses can be far greater than the cost of timely system maintenance.

Loss of reputation and customer trust

Customers expect their data to be properly protected. A security incident can seriously affect trust in the company and its services.

Legal and data protection risks

Depending on the level of risk, a personal data breach may need to be reported to the supervisory authority and, in certain cases, to the individuals affected. Failure to comply with data protection requirements may result in penalties.

One of the most prominent cybersecurity incidents in Latvia in 2026 was the cyberattack on the information technology infrastructure of the Latvian state forestry company AS “Latvijas valsts meži” (LVM).

On 22 June 2026, the company detected a cyber incident, as a result of which several external and internal information systems were shut down for security reasons.

Access to LVM GEO, mapping services and the Mednis hunting app was restricted. Several systems used to exchange information with customers and partners were also unavailable.

The company also reported possible unauthorised access to the data of customers, partners and other individuals. It was later reported publicly that the attackers had obtained and leaked around 44 GB of data.

The technical cause of the incident is particularly significant. Publicly available information indicates that the attackers exploited a previously known vulnerability in a system whose security update had not been applied for about two years.

The incident analysis also revealed problems in the interpretation of security information and in the management of system vulnerabilities. The company had to adapt its day-to-day work; for example, paper waybills were temporarily used for timber deliveries.

This case shows that a single vulnerability left unaddressed can disrupt business processes across the company.

The key lesson: it is not enough simply to receive a vulnerability warning. You need to make sure that the specific system has been checked, the risk correctly assessed and the necessary security update actually applied.

The LVM incident is not related to the PHP vulnerabilities disclosed in October 2026, but it clearly demonstrates the potential impact of unpatched software on data security and business operations.

The report published by ENISA, the European Union Agency for Cybersecurity, in September 2026 confirms that threats to digital infrastructure continue to evolve.

According to ENISA, more than 48,000 new software vulnerabilities (CVEs) were published in 2025, 22% more than in the previous year.

ENISA also notes that ransomware remains one of the cyber threats with the greatest short-term impact on organisations, while public administration remains one of the most frequently attacked sectors.

However, the risks are not limited to the public sector. They also apply to manufacturing, retail, financial services, logistics and other areas of business.

As business processes become increasingly digital, companies also become more dependent on the stability of their IT systems. Cybersecurity is therefore no longer just a matter for the IT department. It is part of a company’s risk management and business continuity.

Software updates are not just about new features or performance improvements. They often include essential security fixes. In response to the PHP vulnerabilities disclosed in October 2026, the developers released the following patched versions:

Particular attention should be paid to outdated and no longer supported PHP versions. If a company’s system is not compatible with newer PHP versions, a safe and controlled migration plan needs to be drawn up.

Not all vulnerabilities are visible to users. A system can run flawlessly while relying on outdated components, insecure integrations or a misconfigured server environment. Regular security checks help identify these risks before they are exploited in a cyberattack.

Important company data must be backed up regularly, stored securely and recoverable when needed. Creating automatic backups alone is not enough; you also need to test that the data can actually be restored.

Employees and partners should have access only to the information they need to carry out their duties. Multi-factor authentication, user permission management and regular access reviews help reduce the risk of unauthorised access.

IT security is not a one-off project. Technologies evolve, new vulnerabilities are discovered, and software versions and business needs change. That is why regular system monitoring, timely updates and professional technical support are essential.

In view of the PHP vulnerabilities disclosed in October 2026, businesses are advised to take the following steps without delay:

1. Find out which systems and servers use PHP.
2. Check the current PHP versions and their support status.
3. Identify publicly accessible and business-critical systems.
4. Prepare backups and a safe update plan.
5. Apply the relevant security fixes and verify that the systems work correctly.
6. Review server logs and any potentially suspicious activity.
7. Assign responsibility for ongoing system maintenance and security monitoring.

If updates cannot be applied immediately, consider restricting access to the vulnerable systems, following the guidance of CERT.LV and the PHP developers.

At the same time, updates should be applied in a controlled way, checking system compatibility, data integrity and operation after the changes have been made.

Important: temporary protective measures do not replace the necessary security updates.

A company does not need to wait for a security incident to start protecting its IT infrastructure.

The HITEXIS team is ready to help businesses respond to the current PHP vulnerabilities and keep their IT systems secure in the long term.

We offer:

• assessment of PHP versions and system components;
• identification and remediation of security vulnerabilities;
• updating PHP and other software components;
• modernisation of existing business systems;
• technical maintenance and monitoring of IT systems;
• consultancy on protecting company data and IT infrastructure.

Our aim is not only to fix a specific technical problem but also to help businesses build a stable, reliable and secure digital environment.

Security is not a one-off task. It is an ongoing responsibility for a company’s data, systems and business processes.

The October 2026 PHP vulnerabilities are yet another reminder that even widely used technologies with a long track record can be exposed to serious security risks. The Latvijas valsts meži cyber incident, in turn, shows the consequences a vulnerability left unaddressed can have.

It is not always possible to predict when the next security risk will be discovered. But it is possible to prepare for it through professional system maintenance, regular updates, security checks and timely risk mitigation.

Company data is an asset. Protecting it is an investment in the company’s stability, reputation and future.

Are you confident that your company’s IT systems are up to date and secure?

Get in touch with the HITEXIS team! We will help you assess the risks, apply the necessary security updates and maintain your IT systems.

• CERT.LV: Critical vulnerabilities in PHP software, 21.10.2026
• CERT.LV: Preventive measures in connection with the PHP vulnerabilities
• Official PHP security updates
• ENISA: Joint statement on critical PHP vulnerabilities
• Statement by the Dutch government
• Statement by the European Patent Office
• Latvijas valsts meži: incident announcement
• CERT.LV: The Latvijas valsts meži incident
• LSM: Analysis of the LVM vulnerability
• ENISA Threat Landscape 2026
• LVM: notice to customers about the personal data breach
• LVM: timber deliveries resume in full
• European Data Protection Board: personal data breaches