Albania issues cybersecurity alerts following threats and vulnerabilities

Albania's National Cybersecurity Authority (AKSK) has issued an urgent notice to public institutions, businesses, and system administrators regarding two critical vulnerabilities in the PHP programming language. Identified as CVE-2026-109618 and CVE-2026-109619, these flaws allow for unauthorized remote code execution. Experts have assigned the vulnerabilities a critical risk rating of 9.2 out of 10 according to the CVSS v4.0 system.

Simultaneously, the Albanian State Police are investigating threatening emails sent to several major government institutions, including the Prime Minister's office, various ministries, and justice organs. The messages contained threats of explosive devices and terrorist acts. Preliminary investigations by cybercrime and anti-terror units indicate the emails originated from an electronic address belonging to an educational institution in Saudi Arabia. Authorities noted that the method resembles previous cases where compromised student email accounts were used to send threats. The police are working with international partners to determine the authenticity of the messages and identify those responsible.