The PHP alert is a test of your response time.

Those questions are the reason this story caught my attention. The warning is serious, but a public advisory is not evidence that every vulnerable company has already been attacked. The confirmed facts are that CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution under the conditions described by PHP's maintainers. The PHP team has issued patched versions for its supported 8.2 through 8.5 branches. The NSA says organizations should act immediately and, if they cannot update, consider taking affected systems offline until they can be mitigated.

This reaches well beyond teams that think of themselves as PHP developers. WordPress, one of the most widely used ways to build a website, runs on PHP. WordPress issued its own notice urging site owners to check their PHP version with their host and update it. The vulnerabilities are in PHP, not WordPress itself, so updating WordPress alone does not apply these fixes. That is exactly the sort of distinction a business owner may miss while assuming a familiar website platform is taking care of everything in the background.

For a smaller business, the hard part may be finding the right system and the right person fast enough. A site might be maintained by an outside developer. A customer portal might be hosted by a vendor. An internal tool might have been set up years ago, with no one on the current team sure which version it runs. The alert can be in everyone's feed while the actual decision sits in no one's hands.

Every day a vulnerable system remains exposed is another day in which someone could try to exploit it. That does not mean a breach is inevitable, and the exposure depends on the system's configuration. It does mean that waiting for the next routine check is a choice with consequences. Someone needs to identify affected services, confirm versions, coordinate the patch with the people who run them, and verify that the update took effect. A technical owner should also review the available evidence for suspicious activity rather than assuming the patch answers every question about what happened before it was installed.

This is where the relationship between a business and its IT managed service provider matters. An MSP can keep an inventory of the systems it manages, receive the security alert, assess which clients are affected, and carry out or coordinate the technical response. Ruby works alongside MSPs so a client can also understand what the alert means for the work that depends on those systems: which service may need to pause, who should communicate with employees or customers, and who is responsible for the decision to bring it back. Our work with Mantra Computing is one example of why we think the technical and business sides should be in the same conversation.

That relationship has to be built before an urgent advisory appears. A company should know who monitors its software and vendors, who receives a critical notice after hours, who approves an interruption, and how it will confirm the fix. Those are ordinary operational questions. Under time pressure, they become cybersecurity questions.