Security researchers warn of critical vulnerabilities in Broadcom Wi-Fi software and PHP

Security researchers have identified significant vulnerabilities affecting millions of devices and web services. A long-standing flaw in Broadcom’s Wi-Fi Protected Setup (WPS) implementation, dubbed ‘WPSplinter’, has existed for 16 years. This vulnerability allows attackers to bypass security checks and remotely inject malicious code, potentially leading to full device takeover. Affected manufacturers may include Asus, TP-Link, Netgear, Cisco, and Linksys. Despite a partial patch released by Broadcom in 2018, the issue remains unresolved for many users, and disabling WPS does not mitigate the risk.

Separately, two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been discovered in PHP, a technology powering a vast portion of the internet. These flaws could allow attackers to execute malicious code on servers without prior authentication, threatening data integrity and service availability. This affects platforms such as WordPress, Joomla, and Drupal. Security experts urge server administrators and hosting providers to update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately to secure their environments.