Slovenia has raised its cybersecurity threat assessment to high after two critical vulnerabilities were identified in PHP, a programming language that supports a vast number of websites and online services. At the same time, a reported data leak at the Serbian subsidiary of Slovenian insurer Sava Re has brought the risks of cyber incidents into sharper focus for the financial sector.
The two developments are separate incidents, and there is no evidence that the PHP vulnerabilities caused the reported breach involving Sava’s Serbian operations. Together, however, they highlight how software weaknesses and attacks against individual organisations can create operational, financial and reputational risks across the digital economy.
On 21 October, Slovenia’s Government Information Security Office (URSIV) classified the cybersecurity threat level as high for entities covered by the country’s Information Security Act, extending the concern to other organisations using PHP or software that depends on it. The assessment remains in force until withdrawn.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were rated 9.2 out of 10 under the CVSS v4.0 severity framework. Under certain conditions, they could allow attackers to execute code remotely on affected servers without authentication, potentially enabling access to systems or sensitive information.
Emergency Patching Becomes a National Priority
The vulnerabilities are particularly concerning because PHP is widely embedded in web applications, content-management systems and other internet-facing services. A weakness in the underlying software can expose many organisations simultaneously, even when their websites are operated by different providers.
Slovenia’s response included a formal order requiring covered organisations and government security operations centres to take urgent protective measures. The order prioritised identifying PHP-based applications, particularly those accessible from the internet, and installing the security updates released on 21 October.
The specified patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or newer compatible versions. Earlier versions are affected, including versions that have reached the end of their supported life.
The order set deadlines of 24 hours to identify affected systems, 48 hours to patch internet-facing systems and seven days to patch other systems, measured from the relevant notification. Where PHP is bundled within another product, organisations are expected to coordinate with the vendor and apply the fix as soon as it becomes available.
The European Union’s cybersecurity authorities have also urged organisations to identify affected systems, work with hosting and software providers, and prioritise internet-facing services.
Sava Re Confirms a Data Leak in Serbia
A separate incident has placed the insurance sector under scrutiny. According to reporting by Finance.si on 22 October, Sava Re confirmed a data leak involving its Serbian subsidiary, Sava Osiguranje. The report said Slovenian policyholders were not affected.
The incident has raised questions about the protection of customer and business information in a cross-border insurance group. Sava Re owns the Serbian non-life and life insurance companies, meaning a cybersecurity incident at a subsidiary can become a group-level issue even when the immediate impact is geographically limited.
Finance.si reported that attackers were threatening to publish sensitive personal and business information relating to customers of Sava Osiguranje. The precise scope and origin of the leaked data remained under investigation at the time of reporting. The claims about the data’s scope should therefore be distinguished from what has been independently established.
The available reporting did not establish that the incident was connected to the newly disclosed PHP vulnerabilities. Nor does the information reviewed here independently confirm the exact categories of exposed data, the timeline of unauthorised access or the status of any regulatory notifications.
Those details matter. A confirmed data leak can trigger obligations to investigate the incident, assess potential harm, secure affected systems and determine whether customers or data-protection authorities must be notified. The precise requirements depend on the facts of the incident and the applicable law.
Image: Cybersecurity, data exposure and corporate risk management.
Why the Two Developments Matter Together
The national alert and the insurance-sector incident illustrate two different dimensions of cybersecurity risk.
The PHP vulnerabilities represent a broad technology exposure: a flaw in widely used infrastructure can affect organisations across industries, creating a race to identify vulnerable systems and install patches. The Sava Osiguranje case, by contrast, illustrates the consequences of a reported incident at a specific business, where the investigation must establish what information was accessed and who may be affected.
For financial services companies, these risks extend beyond IT operations. Customer data is central to insurance contracts, claims processing, payments and customer relationships. A serious breach can disrupt services, require forensic investigation, create legal and regulatory costs and weaken trust.
The distinction between a vulnerability and a confirmed breach is also important. Slovenia’s high threat assessment indicates an elevated risk and the need for urgent protective measures; it does not mean every PHP-based system has been compromised. Likewise, confirmation of a data leak at a Serbian subsidiary does not establish that Slovenian policyholders or the wider group’s systems were affected.
What Businesses Need to Watch
The immediate priority is to determine whether internet-facing systems are running vulnerable PHP versions and whether the required patches have been applied successfully. Organisations also need visibility into software that includes its own PHP runtime or relies on a third-party vendor for updates.
For Sava Re, the central questions are the scope of the leak, the nature of the information involved, whether unauthorised access has ended and what follow-up measures may be required. Further official company disclosures or regulatory information would help clarify the consequences.
More broadly, the incidents underline the importance of maintaining current software, monitoring systems for suspicious activity, controlling access to sensitive information and having a tested incident-response process. These measures cannot eliminate cyber risk, but they can reduce exposure and help organisations respond more effectively when an incident occurs.
Slovenia’s Cyber Risk Moves Into Focus
Slovenia’s decision to classify the PHP threat as high signals the seriousness of vulnerabilities affecting widely deployed internet infrastructure. The separate data leak reported at Sava Re’s Serbian subsidiary shows how cyber incidents can also affect individual businesses and raise questions about customer information, operational resilience and accountability.
The two developments should not be conflated: there is no verified link between them. Their common message is that cybersecurity has become a core operational and governance issue, not simply a technical concern.
For public institutions and companies alike, the next test is implementation—whether vulnerable systems are patched promptly, investigations establish the facts, and any necessary safeguards and notifications follow.
Sources
- Government of Slovenia — URSIV raises cybersecurity threat assessment to high due to critical PHP vulnerabilities
- Government of Slovenia — URSIV orders urgent measures for critical PHP vulnerabilities
- SI-CERT — Critical PHP vulnerabilities, security advisory
- ENISA — Joint statement on critical PHP vulnerabilities
- Finance.si — Cybersecurity and Sava Re reporting
- Sava Osiguranje — Corporate structure
