Security teams issued emergency updates for critical zero day vulnerabilities across PHP, Arista VeloCloud SD WAN, and GitLab self managed servers. The flaws allow unauthenticated remote command execution and administrative takeovers across enterprise infrastructure and web applications. System administrators must apply immediate updates to halt active exploitation and unauthorized server access.
PHP maintainers released updates addressing 2 critical memory flaws tracked as CVE 2026 109618 and CVE 2026 109619. Both vulnerabilities carry a 9.2 rating on the CVSS scale and permit unauthenticated remote command execution on web hosts. The issues stem from improper memory management during request processing, specifically execution with partially initialized internal data and use after free states. Web hosts running Apache mod php face the highest exposure, while PHP FPM, php cgi, FrankenPHP, and LiteSpeed remain vulnerable under specific setups. Government portals in the Netherlands and Finland temporarily suspended online public services as a protective step until technicians applied the fixes. Upgrades are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Arista confirmed active exploitation of a zero day SQL injection vulnerability in VeloCloud Orchestrator, the central management platform for corporate SD WAN deployments. Tracked as CVE 2026 114625 with a 9.9 CVSS score, the flaw allows any user with basic read only customer access to seize full operator rights. Attackers gain local superuser privileges, allowing them to modify network settings and compromise the underlying operating environment. Corporate advisories link active intrusions to 2 malicious IP addresses: 74.82.197[.]86 and 38.54.50[.]151. On premises controllers require immediate upgrades to releases 5.2.3.18, 6.1.3.10, or 6.4.2.12.
GitLab issued security fixes for a maximum severity remote code execution flaw affecting all self managed instances released since version 7.0 in 2014. Tracked as CVE 2026 110264, the flaw holds a 10.0 CVSS score and enables unauthenticated remote code execution via an integer overflow in the Onigmo regular expression compiler. GitLab backported the patch across 7 separate release branches, including versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Single node environments require scheduled downtime while database updates complete, whereas multi node clusters can apply the fix without service interruptions.
