Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

Two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated attackers to execute arbitrary code on affected systems, while a separately exploited flaw in Palo Alto's GlobalProtect VPN remains unpatched. The combination of unpatched software and actively exploited network appliances creates a dangerous attack surface for organizations relying on these technologies. Attackers consistently target known, unpatched vulnerabilities because the barrier to exploitation is low once proof-of-concept tools or scanners are publicly available. The absence of a fix for the Palo Alto flaw underscores the risk of depending on vendor timelines without compensating controls in place. These incidents demonstrate that vulnerability management must be proactive, continuous, and paired with interim mitigations when patches are unavailable.