A critical flaw has just been listed in PHP, the programming language that runs a large share of websites and web applications, including at Quebec SMBs. No attacks exploiting this flaw have been reported so far, but the severity rating is very high and a quick check is warranted.
What is it?
PHP, a language used to run websites, contains a memory-handling error that could let someone take remote control of a server.
According to the official entry on the National Vulnerability Database (NVD), identified as CVE-2026-109618, the error occurs when PHP runs low on memory while processing a request. In certain situations, the program fails to properly clear that memory before reusing it, which can allow remote code execution: that is, a malicious actor running their own instructions on a server that isn’t theirs. Think of it like a garage door you believe is locked, but whose mechanism stays jammed slightly open under certain conditions: as long as no one pushes at the right moment, nothing happens, but the weakness is there.
Why is it serious?
The NVD entry rates this flaw at 9.8 out of 10, one of the highest levels possible. No exploitation has been reported to date.
A score of 9.8 out of 10, per the NVD entry, places this vulnerability among the most serious encountered: it would reportedly be easy to trigger and have significant consequences. For a business, a takeover of a web server can lead to a site or application outage, a leak of customer information, or an entry point for further fraud. The Canadian Centre for Cyber Security considered the situation concerning enough to publish alert AL26-026 on the matter, updated on October 23, 2026.
Who is affected?
Any organization whose website or application runs on PHP, regardless of size.
The product affected is PHP, developed by the PHP Group. The exact versions affected and the patched version are not specified in the records consulted for this article; the AL26-026 alert from the Canadian Centre for Cyber Security should be checked to confirm them. PHP is widely used: online stores, showcase sites, appointment booking systems, client portals. Many Quebec SMBs use it without knowing, because their host or web platform handles it in the background, much like nobody thinks about the furnace as long as it’s heating the house.
How do I check my business?
Four simple checks can tell you whether your business is affected.
- Management asks its host or developer whether the business’s website or application uses PHP, and which version.
- The IT provider checks alert AL26-026 from the Canadian Centre for Cyber Security to confirm the affected versions and the patched version.
- The IT provider or software vendor supplies a written update plan, with a date and a person responsible.
- Management confirms a full backup exists and can be restored before any update is applied.
Scenario
Fictional example: a Quebec dental clinic whose website allows online appointment booking.
The clinic runs an aging version of PHP on its site, managed by an external provider that hasn’t yet applied the patch. One morning, the site becomes unreachable and the booking system goes down. Staff have to go back to answering the phone for the entire day, notify patients of schedule changes, and reschedule some appointments. The provider must first confirm the source of the problem before the site can be brought back online, delaying the return to normal.
What to do now
- Identify the PHP version running on all of the business’s websites, applications, and servers.
- Check alert AL26-026 from the Canadian Centre for Cyber Security to confirm the affected versions and the patched version.
- Request a written update plan from the host or developer, with a specific date and a named person responsible.
- Perform a full backup before any update and confirm it can be restored.
- Apply the fix as soon as it is available, prioritizing sites accessible from the internet.
FAQ
My business doesn’t have a website, am I affected?
If your business does not use any web system running on PHP, either directly or through a third-party provider or platform, this specific risk does not affect you. Check with your providers anyway, since several billing, management, or online booking tools run on PHP without it being visible to you.
Should I panic since the score is so high?
No. No exploitation has been reported to date according to the NVD entry, meaning no confirmed attack has yet been observed. The high score signals a need to act with diligence and not delay, not that an attack is underway. A quick check with your host is generally enough to bring the situation under control.
Who should handle this at my business?
Typically, it’s your web host, developer, or platform provider who applies PHP updates, since they manage the technical infrastructure. Management still has a role: requesting written confirmation that the check has been done and that a plan exists. There is no absolute protection, but a prompt update significantly reduces exposure.
Sources
- CVE-2026-109618 entry from the National Vulnerability Database · NIST, October 21, 2026
- Canadian Centre for Cyber Security: AL26-026 – Vulnérabilités critiques touchant PHP – CVE-2026-109618 et CVE-2026-109619 – Mise à jour 1 · Canadian Centre for Cyber Security, October 23, 2026
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-109618
Article prepared by RISS Canada’s threat watch team based on the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial charter.
