PHP Vulnerabilities Raise Cybersecurity Concerns, CISA Issues Advisory

Cybersecurity experts are concerned about critical remote code execution (RCE) vulnerabilities in PHP, including CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560. These flaws, some decades old, are now more easily exploitable with AI tools, potentially impacting millions of websites. CISA has added an Arista VeloCloud Orchestrator SQL Injection Vulnerability (CVE-2026-114625) to its Known Exploited Vulnerabilities Catalog, urging federal agencies to remediate. The PHP project recommends a temporary mitigation for CVE-2026-115560.