Luxembourg’s Commission de Surveillance du Secteur Financier (CSSF) has issued an urgent alert regarding two critical security vulnerabilities in the PHP runtime that could allow unauthenticated remote code execution across financial services infrastructure. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, pose an immediate threat to institutions relying on PHP-powered services, though the exact affected versions remain unconfirmed at this time.
- Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
- Risk Type: Unauthenticated remote code execution (RCE)
- Affected Systems: All PHP-powered services (versions to be confirmed)
- Notification Requirements: CSSF Circular 25/893 (DORA) or CSSF 24/847, depending on entity type
Until official confirmation of which PHP versions are affected, the CSSF recommends that all supervised financial entities treat any PHP-powered service as potentially exposed and implement appropriate remediation measures immediately. The regulator emphasizes that institutions must take due note of the advisory and act accordingly to protect their systems and customer data.
The CSSF has further reminded supervised entities that unauthenticated remote code execution constitutes unauthorized malicious access and therefore qualifies as a major information and communication technology (ICT)-related incident. Under Luxembourg’s financial regulatory framework, such incidents require mandatory notification through either the Digital Operational Resilience Act (DORA) framework under Circular 25/893 or the alternative notification procedure outlined in Circular 24/847, depending on the entity’s classification within the financial sector.
Financial institutions should prioritize immediate patching upon official version confirmation and conduct comprehensive audits of their PHP infrastructure to identify potential exposure. The CSSF, established as Luxembourg’s financial services regulator, supervises banks, investment firms, insurance companies, and other regulated financial entities operating under Grand Duchy jurisdiction.
