⚠️ #SW_ISAC_ADVISORY

Service providers operating PHP-based platforms please take note of PHP critical vulnerabilities, both rated CVSS v4.0 9.2

Major government and ecommerce services have shut down pending the patch. Exploits are already circulating.

Shut your service down now, and ensure it doesn't have Internet access on restart.

A patch is scheduled for Wednesday, 21 October 2026 at 14:00 UTC

0100 AEDT
2300 JST
1600 CST
1500 BST
1000 EST
0700 PST

https://cert.europa.eu/publications/security-advisories/2026-018/