The site is undergoing essential maintenance and is currently not available
This is for your security following a critical security alert issued yesterday.
Document access is expected to resume at 14:30pm

itsupport@climateactionshortcourse.ie - Thursday 22nd October 2026

Update: October 21, 2026
Saeed Abbasi, Head of Threat Research Unit (TRU), Director of Product, Qualys

PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Apache mod_php deployments warrant immediate attention: PHP reports a demonstrated exploit that can trigger before application code runs.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS v4.0 score of 9.2. Cloudflare has reported attack traffic targeting these vulnerabilities, including attempts to evade its protections.

Organizations should prioritize updates for internet-facing PHP deployments, starting with Apache mod_php. PHP identifies installations serving web requests as at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Exploitability varies by configuration and application behavior.

Active exploitation attempts targeting PHP2Shell have been observed in the wild. Amazon Threat Intelligence and Cloudflare have reported attack activity, while Patchstack has received exploitation reports from hosting partners. Organizations should prioritize patching and review their environments for signs of compromise.