TL;DR
PHP critical RCE flaws (CVE-2026-109618, CVE-2026-109619) affecting ~70% of websites are now [exploitation unverified]; a third unpatched RCE (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) emerged. BlackX UEFI bootkit targets Central Asian diplomats. Microsoft shipped 1,400+ patches; Quest Diagnostics confirms patient data breach.
Executive Summary
- PHP critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 are [exploitation unverified]; the flaw affects nearly 70% of websites and has working public exploits.
- A second unpatched PHP RCE (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) was disclosed with mitigations but no patch available, affecting non-default configurations. ⚠
- BlackX UEFI bootkit is bypassing Secure Boot on Windows systems and targeting diplomatic organizations in Central Asia.
- Microsoft released 1,400+ security patches; Windows Server 2016 reaches end-of-support in January 2027.
- Quest Diagnostics confirms unauthorized access to patient records via compromised Quanum LSM system.
Top Threats Today
1. PHP Critical RCE Flaws Under [exploitation unverified]
Severity: CRITICAL Affected: Technology
Nearly 70% of websites require urgent updates to patch two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow attackers to seize full control of affected servers [1]. Working exploits are publicly available, and operators are actively leveraging the flaw [1]. Two days after emergency patches shipped, PHP disclosed a third unpatched RCE vulnerability (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) that affects applications with non-default configurations . The project considers the third issue an unlikely risk but has published mitigations in lieu of a patch .
Sources:[1] Krebs on Security[2] BleepingComputer
Recommended Action
- Apply latest PHP security patches immediately to CVE-2026-109618 and CVE-2026-109619 if not already done
- For a reported vulnerability (identifier could not be verified against NVD and has been withdrawn), review PHP mitigation guidance and implement recommended configuration hardening for non-default setups
- Monitor web server logs for [exploitation unverified]; segment compromised servers from production networks
- Verify WordPress, Drupal, and other major PHP-based platforms have released security updates
2. BlackX UEFI Bootkit Targeting Diplomatic Infrastructure
Severity: HIGH Affected: Government
A sophisticated UEFI bootkit called BlackX has targeted diplomatic organizations in Central Asia (Tajikistan, Uzbekistan, and Turkmenistan) in early ⚠ 2026 [1]. The malware bypasses Secure Boot protections on patched Windows systems by exploiting missing revocation lists, establishing firmware-level persistence ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Ensure UEFI firmware is up-to-date with latest microcode and security patches
- Enable Secure Boot in UEFI/BIOS settings and verify revocation lists are current
- Monitor endpoint firmware for unauthorized modifications; use Trusted Platform Module (TPM) monitoring tools
- Conduct forensic imaging of systems in affected regions to detect firmware rootkits
3. Microsoft Patches 1,400+ Vulnerabilities in Patch Tuesday
Severity: HIGH Affected: Technology
Microsoft released patches for more than 1,400 security flaws in Windows and other products, including CVE-2026-108398 and CVE-2026-96951 [1]. The patch volume dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load [1]. Additionally, Windows Server 2016 reaches end-of-support in January 2027 and will stop receiving security updates after that date [2].
Sources:[1] Krebs on Security[2] BleepingComputer
Recommended Action
- Prioritize patching Windows systems; test patches in a controlled environment before broad deployment
- Identify and inventory all Windows Server 2016 instances; plan migration to supported versions before January 2027
- Review Microsoft's patch prioritization guidance for the highest-risk vulnerabilities
- Schedule extended maintenance windows to accommodate the large patch volume
4. Quest Diagnostics Data Breach Exposes Patient Records
Severity: HIGH Affected: Healthcare
Quest Diagnostics, a nationwide clinical laboratory company, disclosed that a threat actor gained unauthorized access to its Quanum LSM system, exposing patient records [1]. The scope and number of affected records have not been fully detailed in available disclosures.
Sources:[1] BleepingComputer
Recommended Action
- Affected patients should monitor credit reports and healthcare bills for fraudulent activity
- Organizations using Quest Diagnostics services should verify their data handling practices and review access logs
- Contact your state's healthcare regulator for breach notification requirements and patient communication templates
5. Abandoned Popcorn Time App Exposed Millions to RCE
Severity: HIGH Affected: Technology
A vulnerable updater in the abandoned Time4Popcorn app (a Popcorn Time BitTorrent client fork) exposed millions of computers to remote code execution attacks with elevated privileges [1]. Security researchers remotely disabled the flaw (CVE-2026-30612) before attackers could fully exploit it [1].
Sources:[1] BleepingComputer
Recommended Action
- Uninstall Time4Popcorn and other abandoned BitTorrent clients from all systems
- Scan systems that previously ran the application for signs of compromise or malware installation
- Use endpoint detection and response (EDR) tools to detect lateral movement or persistence attempts
Today’s Action Checklist
- ☐ CRITICAL: Verify all PHP web servers are patched for CVE-2026-109618 and CVE-2026-109619; prioritize sites running WordPress, Drupal, or other high-traffic PHP platforms
- ☐ URGENT: Review PHP mitigation steps for a reported vulnerability (identifier could not be verified against NVD and has been withdrawn) and assess if your non-default PHP configurations are affected
- ☐ URGENT: Test and deploy Microsoft's 1,400-patch bundle in non-production environments; plan staged rollout
- ☐ HIGH: Check systems in Central Asia and diplomatic agencies for signs of UEFI/bootkit compromise; enable and verify Secure Boot status
- ☐ HIGH: If using Quest Diagnostics services, verify your breach notification timeline and patient communication plan; if Time4Popcorn is detected in asset inventory, flag for removal and forensic analysis