As two critical vulnerabilities prompt companies worldwide to scramble to patch them, cybersecurity experts are urging Bermuda organisations to check whether their websites and online systems use the affected PHP software.

The vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, could let an attacker execute commands on an affected web server.

PHP is a common programming language that works behind the scenes on websites and applications.

Mike Perkins, chief information security officer at Bermuda’s Northrock Cybersecurity, told The Royal Gazette that the threat could let an attacker take control of a vulnerable server without even needing to sign in.

“These two flaws could allow an attacker to make an affected web server follow their instructions without logging in,” he said.

He said the potential fallout goes beyond a company’s own systems and information. An attacker could use a compromised but trusted website to place fake sign-in pages to steal passwords, scam users or offer malicious downloads.

“They could then turn a trusted website against its visitors,” Mr Perkins said.

He added that simply visiting an affected website did not automatically infect a user’s computer, but the trust placed in that site could be exploited.

Mr Perkins said Bermuda organisations faced the same exposure as those elsewhere, including in government, international business, tourism and smaller enterprises. However, he said not to assume that every website was vulnerable.

He said business owners might know their website uses WordPress without realising that WordPress relies on PHP. They might also assume that a developer or overseas hosting provider was handling all software security updates without confirming whose responsibility it is.

Rafal Baran, co-chairman of the Cybersecurity Executives of Bermuda, said the greater risk could lie with smaller organisations and older websites, particularly where no one knows who is responsible for maintenance. Official fixes have been released only for supported PHP versions, meaning an outdated site may need a fuller upgrade rather than a routine update.

The question for organisations, he said, was: “Are we using affected PHP software anywhere, and has the security fix been applied and verified?”

Mr Baran put the question more simply: “Any organisation with a website should be asking its web provider today: do we run PHP, and have we patched?”

The vulnerabilities have also shown how artificial intelligence can change the cyber-risk posed by a longstanding weakness. The PHP Foundation said signs of one underlying problem had been recognised in 2024, but no attack route was then known.

Researchers later used AI-assisted analysis, exploit development and testing to show that the weakness could permit remote code execution. Mr Perkins said AI had not acted independently, but had made developing and adapting practical attacks easier.

“It substantially reduced the difficulty of developing and adapting working exploits,” he said.

Ronnie Viera, co-chairman of the Cybersecurity Executives of Bermuda, said the episode showed how quickly the window between discovering a serious weakness and exploiting it could close. He added that organisations needed an up-to-date picture of the software and services they use so that they can apply patches quickly.

There was no confirmed Bermuda-specific incident. However, Amazon’s threat-intelligence team reported attempted exploitation from October 17, before the security updates were publicly released.

“That should not be interpreted as an all-clear,” Mr Perkins said.

He urged organisations to contact whoever manages their website and hosting, identify any affected PHP installations, apply the update and make sure that it is running. They should also preserve and review logs from at least October 17 and look for unexpected files, changes or activity.

“Patching is like repairing a broken lock,” Mr Perkins said. “It closes that entry point, but it does not tell you whether someone entered beforehand or left another way back in.”