PHP Flaws in btrfs-backup-ng Allow Remote Code Execution

• •Two serious PHP vulnerabilities in btrfs-backup-ng could allow remote code execution.
• •Affected systems include various setups running vulnerable PHP versions.
• •Users are urged to update to version 0.9.20 to mitigate risks.

Two serious security vulnerabilities in btrfs-backup-ng could allow attackers to execute arbitrary code without authentication. These flaws affect various setups and PHP versions, enabling local users to manipulate backup processes through symbolic links. The vulnerabilities were addressed in the 0.9.20 update released on November 1, 2026, which also included fixes for concurrency and lock issues. The vulnerabilities are tracked under CVE-2026-XXXX and CVE-2026-YYYY, but specific CVE identifiers were not disclosed in the articles. Users are advised to update to the latest version to mitigate the risks. The flaws highlight the importance of securing backup configurations against local user manipulation. The impact is significant as it could lead to unauthorized access to sensitive backup data.