The National Commission for Data Protection (CNPD) draws the attention of data controllers and data processors to two critical vulnerabilities affecting the PHP runtime environment, identified under the references CVE-2026-109618 and CVE-2026-109619.
These vulnerabilities could allow malicious actors to remotely execute commands on the affected systems without prior authentication. Systems running a vulnerable version of PHP that has not been updated and which are accessible from the internet are particularly at risk. Exploitation of these vulnerabilities is likely to compromise the security of IT systems and, in particular, the confidentiality, integrity and availability of personal data processed on them.
Security patches have been available since 21 October 2026 for PHP versions 8.2, 8.3, 8.4 and 8.5. The patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 respectively.
Organisations and individuals using PHP are urged to check their exposure to these vulnerabilities without delay and to carry out the necessary security updates, taking into account, where applicable, the patches provided by their software publishers or service providers.
Recommended security measures
The CNPD reminds organisations that, under Article 32 of the General Data Protection Regulation (GDPR), controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks presented by the processing of personal data.
In this context, the CNPD encourages the organisations concerned to:
- Identify systems and applications that use PHP, particularly those accessible from the Internet;
- Check the installed versions and apply the appropriate security patches without delay, taking into account the recommendations of the relevant vendors and suppliers;
- Contact their IT service providers and processors, particularly hosting providers, to make sure the necessary security measures have been implemented;
- Step up monitoring of potentially exposed systems to detect any signs of compromise;
- Assess the consequences of a possible security incident for personal data, as well as the resulting risks to the rights and freedoms of the data subjects.
The CNPD also invites the organisations concerned to consult the technical recommendations published by the Computer Incident Response Center Luxembourg (CIRCL), which advises updating the affected PHP environments immediately.
Obligations in the event of a personal data breach
The CNPD points out that the existence of a security vulnerability does not, in itself, constitute a personal data breach within the meaning of the GDPR.
However, where a security incident results in, among other things, unauthorised access to, disclosure, alteration, loss or destruction of personal data, controllers must examine their obligations under Articles 33 and 34 of the GDPR.
Under Article 33 of the GDPR, any personal data breach must be notified to the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after the controller becomes aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Where the breach is likely to result in a high risk to the rights and freedoms of the data subjects, they must also be informed without undue delay, subject to the exceptions set out in Article 34 of the GDPR.
The CNPD encourages organisations to be particularly vigilant and to document security incidents affecting personal data, in line with GDPR requirements.
Further information
For more information on these vulnerabilities and the recommended technical measures, the organisations concerned are invited to consult the following official communications:
- CIRCL – Report TR-102: https://new.circl.lu/pub/tr-102/
- PHP – Security advisory of 21 October 2026: https://www.php.net/archive/2026.php#2026-10-21-5
For any information on obligations relating to the security of processing and the notification of personal data breaches, organisations can consult the CNPD website: https://cnpd.public.lu.