In October 2026, critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered in PHP affecting multiple supported versions. These vulnerabilities allow unauthenticated attackers to execute code remotely due to out-of-memory corruption and stale global state issues. Emergency security updates were released on October 21, 2026, for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Mitigations exist but are incomplete; updating to the fixed versions is strongly recommended. Additional incidents involving LiteLLM, eMudhra, GitLab, Railway, and Zeabur were also reported in the same timeframe. The PHP project continues to address these issues with further advisories and release candidates.
This threat highlights the increasing security risks posed by third-party vendor failures rather than direct attacker actions. The referenced Cloudflare incident illustrates how vulnerabilities or failures in vendor systems can create significant blind spots in an organization's security posture. European organizations relying on cloud and third-party services may face disruptions or data exposure due to such indirect failures. The threat emphasizes the importance of rigorous vendor risk assessments and continuous monitoring of third-party security practices. Although no direct exploit or CVE is identified, the medium severity reflects the potential for confidentiality, integrity, and availability impacts stemming from vendor issues. Mitigation requires enhanced due diligence, contractual security requirements, and real-time vendor monitoring. Countries with high cloud adoption and critical infrastructure reliance on third-party providers, such as Germany, France, and the UK, are most likely to be affected. Given the indirect nature and lack of direct exploitation, the suggested severity is medium. Defenders should prioritize strengthening third-party risk management to reduce exposure to such incidents.
Red Hat confirms security incident after hackers breach GitLab instance
Source: https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/
