On 21 October 2026, updates were released for two critical vulnerabilities in PHP - a technology widely used for websites, online stores, and business applications. The vulnerabilities may expose companies to the risk of unauthorized access to systems and data, including where the maintenance of the relevant services has been outsourced. This alert summarizes the specific steps companies should verify with their IT teams and the legal obligations that may arise if an incident is identified.
The vulnerabilities CVE-2026-109618 and CVE-2026-109619 may allow malicious actors to execute code on affected servers without prior authentication.
Potential consequences include the compromise of information systems, unauthorized access to commercial information or customer data, disruption of online services, and more.
The available updates should be applied promptly, as temporary protective measures do not guarantee complete protection.
The risk is relevant to any organization that uses PHP in its websites, customer portals, online stores, or other online applications.
The first step is to determine whether the systems in use are vulnerable. Companies should immediately contact their IT teams or technology providers to check whether their websites or online services are affected. If they are, ensure that the necessary security updates are applied promptly.
Outsourcing hosting or technical support to an external provider does not eliminate the risk to the company, nor does it necessarily release the organization from the relevant legal obligations.
No, not necessarily. The mere presence of a vulnerability does not mean that an incident or a security breach affecting your systems or data has occurred. A cybersecurity incident is an actual breach of the security of systems, services, or data. It may also constitute a personal data breach where personal data has been accessed without authorization or disclosed, altered, destroyed, or lost, including where access to it has been lost. Accordingly, a cybersecurity incident may occur without affecting personal data, while the same event may fall into both categories.
We recommend activating your incident response procedures and coordinating actions with your IT team and legal department in order to contain the incident, preserve evidence, and assess any notification obligations. Where personal data is affected, notification under the GDPR may be required within 72 hours of becoming aware of the breach. Separate notification requirements in the field of cybersecurity should also be assessed, together with those arising under your contracts with customers, partners, and technology providers.
Obligations under the GDPR and cybersecurity legislation are assessed separately and may arise in parallel. Notification under one regime does not automatically replace notification under the other.
The team at Dimitrov, Petrov & Co. (DPC) advises companies on matters relating to personal data protection, cybersecurity, and the legal consequences of network and information security incidents.
We can assist in assessing incidents and the applicable notification obligations, communicating with competent authorities, affected individuals, and business partners, as well as analyzing contractual relationships and the responsibilities of technology providers.
If signs of system or data compromise are identified, we recommend seeking legal advice promptly.
This material is for information purposes only and does not constitute legal advice in relation to any specific matter.
With technology and data in her heart, Desislava over 20 years of unmatched experience exclusively practicing in the legal areas of information technologies, privacy, and data protection.
Nevena combines private-practice expertise with substantial in-house experience in technology-driven organisations, regulated compliance and legal-tech entrepreneurship. Her work reflects a practical understanding of how legal requirements affect products, people and business operations.
