Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
CISA · Alert ·
Critical Vulnerabilities in PHP Require Immediate Patching
CISA urges organizations to patch PHP vulnerabilities.
CVE-2026-109618 and CVE-2026-109619 affect all PHP installations serving web requests, allowing unauthenticated remote code execution. CISA has not observed exploitation. PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 fix these vulnerabilities.
Recommended by the publisher: CISA recommends updating to a patched PHP version immediately, prioritizing internet-facing systems.
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA urges patching BeyondTrust Remote Support vulnerability CVE-2026-102764.
CISA is aware of a critical authentication bypass vulnerability affecting BeyondTrust Remote Support versions 26.2.3 and earlier. Cyber threat actors are actively exploiting the vulnerability. Patches are available for supported versions.
Recommended by the publisher: CISA recommends applying the BT26-05-RS patch and reviewing BeyondTrust’s security advisory.
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
CISA advises patching Ivanti Connect Secure.
CISA is aware of cyber threat actors exploiting CVE-2026-104935 in Ivanti Connect Secure versions 25.1.1.1 and prior. This vulnerability allows remote execution of arbitrary commands. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog.
Recommended by the publisher: CISA urges organizations to update to the latest version.
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
CISA alerts on critical vulnerabilities in Citrix NetScaler ADC, Gateway.
CISA has updated its Alert to provide a SIGMA detection rule resource to help identify potentially suspicious activity. CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products. CISA has received reports confirming that threat actors are actively exploiting these vulnerabilities globally.
Recommended by the publisher: CISA urges users and administrators to review Citrix’s advisories and patch.