Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated attackers to execute code on affected web servers. Both carry a CVSS v4.0 score of 9.2, and exploitation attempts are already being observed in the wild.

PHP has released the following fixed versions:

PHP branch
Fixed version

PHP 8.5
8.5.12

PHP 8.4
8.4.27

PHP 8.3
8.3.36

PHP 8.2
8.2.35

If you manage your own server or VPS, install the appropriate update immediately.

Continue reading Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619) at Sucuri Blog.

Starting August 10, 2026, Sucuri will begin moving customer account logins to a new authentication platform designed to provide a stronger, more modern sign-in experience.

The rollout will happen gradually over the following few weeks, so not every account will transition at the same time.

For most users, there is nothing to do. Your password will remain the same, your current two-factor authentication setup will continue working, and existing bookmarks to the Sucuri dashboard login page will automatically redirect to the new sign-in page.

Continue reading Upgrading How You Sign In to Your Sucuri Account at Sucuri Blog.