A business website can be current at the application level while its underlying software still needs attention. Fresh Saudi and Bahraini warnings highlight that gap, alongside a different risk: attackers abusing a trusted, signed executable. For founders, CTOs and software houses serving the UAE, Saudi Arabia and Oman, the practical priority is to identify the affected layer and the person responsible for fixing it.
PHP: a website update must include the underlying runtime
Bahrain’s National Cyber Security Center issued a critical PHP warning on 21 October. That day, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. These weaknesses affect the PHP runtime beneath websites and applications. Updating a CMS or plugin alone does not repair that layer. [1][2][3]
The fixed upstream releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Ask the hosting provider or application operations owner to identify the runtime actually serving each site and confirm the appropriate fixed release or verified distribution backport. Older branches need explicit vendor-support or upgrade decisions. [2]
Cloudflare reported observing attack traffic targeting its customers and recommended patching even where WAF protections are enabled. That is evidence of attempted exploitation; the report does not quantify losses at GCC businesses. Potential business effects include exposure of customer information, altered websites and service interruption. [3]
PHP also published a 23 October follow-up about a rare additional execution path involving session upload progress and runtime changes to the session serialization handler. Have the maintainer review that notice alongside the upgrade, including its recommendation to disable upload progress and its exception for applications that never change the handler at runtime. [2]
Brotli: find the vulnerable copy inside the application stack
Saudi NCA issued a critical Brotli alert on 25 October, identifying its use in Node.js, Python, Bun, Envoy and other products. Node.js had released security updates on 21 October for CVE-2026-111497 in its bundled Brotli decoder. Google’s Brotli project also published security releases that day. [4][5][6]
The Node.js issue applies when an attacker can supply Brotli-compressed data that the application decompresses. Memory corruption can cause a crash, disclose process memory or potentially execute code. Applicability depends on the runtime and data path; the Saudi warning does not establish a regional compromise. [5]
For the supported Node.js branches covered by the release, the fixed versions are 22.23.4, 24.22.1 and 26.12.1. Check the deployed runtime, including vendor-bundled applications, rather than assuming an npm dependency update fixes Node.js itself. Other products need their own vendor’s remediation instructions. [4][5]
For containerised services, rebuild and redeploy affected images using updated components, then verify what is running. Docker’s standing guidance explains that images are snapshots containing their base software and libraries; changing a development machine does not replace an already-deployed image. [7]
Signed software: verify the surrounding files and launch behaviour
On 19 October, Siemens confirmed active exploitation of CVE-2026-110936 using a genuine, digitally signed copy of Siemens Software Center alongside malicious DLL files. Its original advisory was published on 15 October; the 19 October update added the exploitation report. Bahrain issued a corresponding warning on 20 October. [8][9][10]
The attackers distributed the bundle outside official channels. The legitimate executable loaded their companion files when started. Siemens reported no known breach of its systems, products or update channel. This campaign therefore requires different questions from a remotely exploitable web-server flaw. [8]
For an MSP or a business managing Windows workstations, a valid signature is insufficient evidence that an entire downloaded bundle is safe. Check unexpected installations, execution from unusual user-profile locations and suspicious companion DLLs against the vendor’s investigation guidance. Approved Software Center installations should be on 4.0.9.8 or later. Signs of compromise require incident response as well as updating. [8][9]
Remind staff that a real CAPTCHA check does not require pasting commands into Run or PowerShell. Keep software downloads tied to official sources. [8]
Three actions for this week
- Assign each layer: record who maintains the application, PHP or Node.js runtime, container image and relevant endpoint software. Obtain evidence for customer environments, not just the team’s own systems.
- Prioritise applicable exposure: address affected public-facing PHP services and Brotli-decoding paths; investigate suspicious signed-software bundles separately. Preserve evidence where compromise is suspected. [2][5][8]
- Verify completion: record the deployed version or vendor backport, test critical customer journeys after changes, and retain the remediation record. Rebuild affected container images before closing the task. [7]
A useful question for a software house or MSP to ask its customer is: “Who can show that the fix reached the system actually handling our customers’ requests?”
If your team cannot establish which applications are exposed, bring the inventory to Nordic Defender to scope an authorised assessment or remediation retest. Partners can use a defined customer scope to discuss joint assessment delivery. [11]
Sources
1. Bahrain National Cyber Security Center — Critical PHP Vulnerabilities — Immediate Preparation Required, NCSC-TAD-2610-002 — Advisory dated 21 October 2026.
2. The PHP Group — PHP News Archive 2026 — critical security release and session upload progress follow-up — Relevant notices published 21 and 23 October 2026.
3. Cloudflare — Cloudflare deploys protections against php2shell vulnerability — Published 21 October 2026.
4. Saudi National Cybersecurity Authority — Brotli alert 2026-7959 (listed as “Brotil”) — Published 25 October 2026.
5. The Node.js Project — Wednesday, October 21, 2026 Security Releases — Security release dated 21 October 2026.
6. Google Brotli maintainers — Brotli v1.2.1 security release — Released 21 October 2026.
7. Docker — Building best practices — rebuild your images often — Publication / update date not stated; standing build guidance.
8. Siemens ProductCERT — Active Exploitation of CVE-2026-110936 in Siemens Software Center — Published 19 October 2026.
9. Siemens ProductCERT — SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center — First published 15 October 2026; updated to version 1.2 on 19 October 2026.
10. Bahrain National Cyber Security Center — Attackers Exploit Siemens Software Center to Load Malicious DLLs, NCSC-TAD-2610-001 — Advisory dated 20 October 2026.
11. Nordic Defender — Penetration Testing as a Service — Publication / update date not stated.