PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats

PHP critical RCE flaws ( CVE-2026-109618 , CVE-2026-109619 ) affecting ~70% of websites are now [exploitation unverified]; a third unpatched RCE (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) emerged. BlackX UEFI bootkit targets Central Asian diplomats. Microsoft shipped 1,400+ patches; Quest Diagnostics confirms patient data breach.

PHP critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 are [exploitation unverified]; the flaw affects nearly 70% of websites and has working public exploits.

A second unpatched PHP RCE (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) was disclosed with mitigations but no patch available, affecting non-default configurations. ⚠

BlackX UEFI bootkit is bypassing Secure Boot on Windows systems and targeting diplomatic organizations in Central Asia.

Microsoft released 1,400+ security patches; Windows Server 2016 reaches end-of-support in January 2027.

Quest Diagnostics confirms unauthorized access to patient records via compromised Quanum LSM system.

1. PHP Critical RCE Flaws Under [exploitation unverified]

Severity: CRITICAL Affected: Technology

Nearly 70% of websites require urgent updates to patch two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow attackers to seize full control of affected servers [1] . Working exploits are publicly available, and operators are actively leveraging the flaw [1] . Two days after emergency patches shipped, PHP disclosed a third unpatched RCE vulnerability (a reported vulnerability (identifier could not be verified against NVD and has been withdrawn)) that affects applications with non-default configurations . The project considers the third issue an unlikely risk but has published mitigations in lieu of a patch . Sources: [1] Krebs on Security [2] BleepingComputer

Apply latest PHP security patches immediately to CVE-2026-109618 and CVE-2026-109619 if not already done

For a reported vulnerability (identifier could not be verified against NVD and has been withdrawn), review PHP mitigation guidance and implement recommended configuration hardening for non-default setups

Monitor web server logs for [exploitation unverified]; segment compromised servers from production networks

Verify WordPress, Drupal, and other major PHP-based platforms have released security updates

2. BlackX UEFI Bootkit Targeting Diplomatic Infrastructure

Severity: HIGH Affected: Government

A sophisticated UEFI bootkit called BlackX has targeted diplomatic organizations in Central Asia (Tajikistan, Uzbekistan, and Turkmenistan) in early ⚠ 2026 [1] . The malware bypasses Secure Boot protections on patched Windows systems by exploiting missing revocation lists, establishing firmware-level persistence ⚠ [1] . Sources: [1] The Hacker News

Ensure UEFI firmware is up-to-date with latest microcode and security patches

Enable Secure Boot in UEFI/BIOS settings and verify revocation lists are current

Monitor endpoint firmware for unauthorized modifications; use Trusted Platform Module (TPM) monitoring tools

Conduct forensic imaging of systems in affected regions to detect firmware rootkits

3. Microsoft Patches 1,400+ Vulnerabilities in Patch Tuesday

Severity: HIGH Affected: Technology

Microsoft released patches for more than 1,400 security flaws in Windows and other products, including CVE-2026-108398 and CVE-2026-96951 [1] . The patch volume dwarfs September's record of nearly 1,000 fixes, which was already ten times the normal monthly patch load [1] . Additionally, Windows Server 2016 reaches end-of-support in January 2027 and will stop receiving security updates after that date [2] . Sources: [1] Krebs on Security [2] BleepingComputer

Prioritize patching Windows systems; test patches in a controlled environment before broad deployment

Identify and inventory all Windows Server 2016 instances; plan migration to supported versions before January 2027

Review Microsoft's patch prioritization guidance for the highest-risk vulnerabilities

Schedule extended maintenance windows to accommodate the large patch volume

4. Quest Diagnostics Data Breach Exposes Patient Records

Severity: HIGH Affected: Healthcare

Quest Diagnostics, a nationwide clinical laboratory company, disclosed that a threat actor gained unauthorized access to its Quanum LSM system, exposing patient records [1] . The scope and number of affected records have not been fully detailed in available disclosures. Sources: [1] BleepingComputer

Affected patients should monitor credit reports and healthcare bills for fraudulent activity

Organizations using Quest Diagnostics services should verify their data handling practices and review access logs

your state's healthcare regulator for breach notification requirements and patient communication templates

5. Abandoned Popcorn Time App Exposed Millions to RCE

Severity: HIGH Affected: Technology

A vulnerable updater in the abandoned Time4Popcorn app (a Popcorn Time BitTorrent client fork) exposed millions of computers to remote code execution attacks with elevated privileges [1] . Security researchers remotely disabled the flaw (CVE-2026-30612) before attackers could fully exploit it [1] . Sources: [1] BleepingComputer

Uninstall Time4Popcorn and other abandoned BitTorrent clients from all systems

Scan systems that previously ran the application for signs of compromise or malware installation

Use endpoint detection and response (EDR) tools to detect lateral movement or persistence attempts

Today’s Action Checklist

☐ CRITICAL: Verify all PHP web servers are patched for CVE-2026-109618 and CVE-2026-109619; prioritize sites running WordPress, Drupal, or other high-traffic PHP platforms

☐ URGENT: Review PHP mitigation steps for a reported vulnerability (identifier could not be verified against NVD and has been withdrawn) and assess if your non-default PHP configurations are affected

☐ URGENT: Test and deploy Microsoft's 1,400-patch bundle in non-production environments; plan staged rollout

☐ HIGH: Check systems in Central Asia and diplomatic agencies for signs of UEFI/bootkit compromise; enable and verify Secure Boot status

☐ HIGH: If using Quest Diagnostics services, verify your breach notification timeline and patient communication plan; if Time4Popcorn is detected in asset inventory, flag for removal and forensic analysis