
Pakistan's National CERT Warns of Critical Cyber Threats to Government Portals and Financial Institutions
▫️ Government departments, regulators and financial institutions urged to deploy security updates, strengthen web application firewalls and monitor suspicious activities
Pakistan's National Cyber Emergency Response Team (National CERT) has issued an urgent cybersecurity advisory warning government departments, financial institutions and organisations operating critical online services about two serious vulnerabilities in PHP based systems that could expose websites and applications to cyberattacks.
The advisory, circulated to federal ministries, government departments, regulatory authorities, public-sector companies, financial institutions and information technology service providers, calls for immediate protective measures to safeguard digital infrastructure, online services and sensitive information.
According to National CERT, two critical vulnerabilities, identified as CVE 2026 109618 and CVE-2026 109619, have been discovered in PHP systems widely used to operate websites, online portals and business applications.
Both vulnerabilities carry severity scores of 9.2 out of 10 under the Common Vulnerability Scoring System, indicating a substantial cybersecurity risk to affected systems.
Successful exploitation could potentially enable unauthorised attackers to execute malicious code remotely, gain access to sensitive information or interfere with normal server operations without requiring prior authentication.
National CERT has directed relevant organisations to identify vulnerable PHP installations, prioritise security updates and strengthen protection for internet-facing applications.
The advisory also emphasises the use of web application firewalls (WAFs) as an additional protective measure against potentially malicious requests and attempts to exploit vulnerable web services.
IT departments and cybersecurity teams have been advised to maintain close monitoring of system logs, identify unusual activity and investigate potential indicators of compromise.
Organisations have also been instructed to report suspected system intrusions, unauthorised access and web shell activity promptly to National CERT Pakistan.
The warning is particularly relevant to organisations operating online financial platforms, government information systems and business applications that depend on affected PHP technologies.
It may also have implications for digital systems used in the property and construction sectors, including online land record services, property transfer portals, housing development platforms, building approval systems and electronic payment services, where those platforms rely on vulnerable PHP installations.
However, the advisory does not establish that any specific Pakistani land records platform, development authority or property portal has been compromised.
The actual exposure of individual services depends on their software versions, hosting environments, security configurations and the measures already implemented by their operators.
International cybersecurity authorities have issued similar warnings following the disclosure of the vulnerabilities.
The PHP development team released emergency security fixes on October 21, 2026, while cybersecurity agencies across several countries urged website administrators and service providers to apply the updates immediately.
Security specialists have emphasised that web application firewalls should supplement, rather than replace, software patching and continuous system monitoring.






















.png)




