Two critical security vulnerabilities have been identified in PHP, the technology behind many websites and web applications, including many WordPress websites. The vulnerabilities may allow an attacker to remotely compromise an affected server. Security updates are scheduled for release on 21 October 2026. [cert.europa.eu], [phoenix.security]

What ABit is doing

ABit Systems will monitor and update systems that we manage where we are able to do so.

However, some websites, hosting services and applications may be managed by third-party providers and fall outside the services ABit provides. This is particularly relevant if you have a:

• WordPress website
• E-commerce website
• Custom web application
• Website hosted or maintained by another provider

What you should do

If another company manages your website or hosting, please contact them and confirm:

• Whether your website or hosting environment uses PHP.
• Whether it is affected by CVE-2026-109618 or CVE-2026-109619.
• When the required security updates will be applied.

If you use an older or unsupported platform, your provider should also confirm whether a security update will be available or whether the platform needs to be upgraded.

AI-built and "vibe-coded" applications

We also strongly recommend reviewing any websites, applications, portals or internal tools that have been created using AI coding or "vibe coding" tools.

Examples include:

• Lovable
• Replit
• Bolt
• v0
• Claude Code
• GitHub Copilot
• Cursor
• Similar AI-assisted development tools

The concern is not that these AI tools are necessarily affected by the PHP vulnerabilities. The concern is that AI-assisted development has made it much easier for applications to be created and published without going through normal IT management and security processes.

Security research has identified vulnerabilities in AI-generated applications, including problems with access controls, exposed credentials and other application security weaknesses. [pentest.ae], [securityweek.com]

This means your organisation could have an Internet-accessible application that ABit, or even your internal IT team, does not know exists.

If staff have created applications using AI coding tools, please make sure they are included in your security review.

For any Internet-accessible AI-built application, you should be able to establish:

• Who is responsible for managing and securing it.
• Where it is hosted.
• What technologies it uses, including whether PHP is involved.
• Whether its underlying software and dependencies are being maintained and patched.
• Whether it contains or provides access to business, customer or personal information.

If you cannot determine who manages an application, what technology it uses, or whether it is being kept secure and patched, we recommend considering temporarily removing it from public access until it can be properly assessed.

ABit may not be able to monitor websites or applications that we don't manage or haven't been made aware of.

If you're unsure whether ABit manages a particular website or application, or whether something may be affected, please contact us and we can help determine the appropriate next step.