Sakura Internet Suspends Three Database Tools After PHP Flaws

Sakura Internet suspended phpMyAdmin, phpPgAdmin and pgAdmin on its Database Appliance on Oct. 21. The three web-based tools give customers browser access to database management, while the separate Database Cluster is excluded from the suspension.

Sakura set no date for restoring the tools and recommended MariaDB- or PostgreSQL-compatible SQL clients as alternatives.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could let an attacker execute code remotely without authentication. Each has a CVSS v4.0 score of 9.2 out of 10. The flaws affect PHP installations that handle web requests, including PHP-FPM and Apache’s mod_php; mod_php carries the highest risk.

The flaws were addressed in PHP’s Oct. 21 patch release. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The scheduled release time was 10 a.m. ET (14:00 UTC) on Oct. 21. PHP 8.1 and older no longer receive project updates, though source backports were prepared for versions 7.4, 8.0 and 8.1.