On October 21, 2026, PHP developers released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2. These flaws allow for remote code execution without authentication, necessitating immediate system updates.
The Nocturne security tool, developed by the SoftBalance x sbsecurity division, began identifying CVE-2026-109619 on the same day the vulnerability details were disclosed. The team successfully scanned SoftBalance infrastructure and updated all affected components to secure their systems.
SoftBalance specialists submitted technical data regarding CVE-2026-109619 to the FSTEC Russia threat database. The agency confirmed receipt of the information and updated the corresponding vulnerability record in their system.
The company emphasizes that automated monitoring tools like Nocturne are essential for detecting risks between scheduled audits. The SoftBalance x sbsecurity team is now offering infrastructure scanning and remediation services to external clients.
