Tenable Security Center Patch SC-202610.1 Updates PHP
Tech GuruQuick Answer
TNS-2026-28 addresses CVE-2026-109618 and CVE-2026-109619 in Tenable Security Center 6.9.1 and earlier. Apply patch SC-202610.1, verify the embedded PHP 8.2.35 component and service health, test normal operations, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Tenable Security Center deployments, exact versions, nodes, embedded PHP, exposure, integrations, owners, backups, and maintenance windows. Match each deployment to the authority's affected statement: Tenable Security Center 6.9.1 and earlier. Do not infer exposure from a different Tenable product or PHP installation. Obtain and apply stand-alone patch SC-202610.1 through the supported Tenable channel, following product-specific installation and rollback guidance. Confirm patch state and embedded PHP 8.2.35, verify service and cluster health, test scans, integrations, authentication, reporting and recovery as applicable, and retain evidence.
Last verified: 2026-10-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Tenable Security Center |
|---|---|
| Advisory | TNS-2026-28 |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-22 |
| Authority revision date | 2026-10-22 |
| Affected versions | Tenable Security Center 6.9.1 and earlier |
| Fixed version | Tenable patch SC-202610.1 with PHP 8.2.35 |
| CVSS base score | 9.8 base / 8.8 temporal (CVSS v3.1); 9.2 base (CVSS v4.0) |
| CVSS severity | Critical |
| Exploitation status | Tenable does not state that these issues are being maliciously exploited against its products.; no exploitation claim is inferred. |
What Changed
Tenable released stand-alone patch SC-202610.1 for Tenable Security Center, updating the embedded PHP component to 8.2.35 for two PHP runtime vulnerabilities.
What To Validate Now
- Inventory. Inventory Tenable Security Center deployments, exact versions, nodes, embedded PHP, exposure, integrations, owners, backups, and maintenance windows.
- Establish applicability. Match each deployment to the authority's affected statement: Tenable Security Center 6.9.1 and earlier. Do not infer exposure from a different Tenable product or PHP installation.
- Remediate. Obtain and apply stand-alone patch SC-202610.1 through the supported Tenable channel, following product-specific installation and rollback guidance.
- Validate. Confirm patch state and embedded PHP 8.2.35, verify service and cluster health, test scans, integrations, authentication, reporting and recovery as applicable, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The same patch identifier covers distinct Tenable products; use the correct product package and instructions. Preserve backups and account for clustered or disconnected deployments before change.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
