Mitigation for PHP vulnerability impacting certain areas of GravityZone

Update timeline

1. monitoring Oct 21, 2026, 09:02 AM UTC

   On October 20, 2026, two critical remote code execution vulnerabilities in PHP were publicly announced, rated 9.2 (CVSS v4.0). Technical details have not yet been disclosed, and PHP has not published a workaround. As a precaution, we have temporarily disabled all GravityZone Cloud capabilities that involve uploading files. Endpoint protection, policy enforcement, and detection continue to operate. Policy settings, exclusions, and rules can still be added manually; only CSV import is affected. We have found no evidence that these vulnerabilities have been exploited against GravityZone. Why we did this These vulnerabilities could allow remote code execution, and their full scope is not yet known. Until fixed PHP versions are deployed and validated across our infrastructure, we chose to remove the exposure created by file uploads rather than accept that risk for your environment and our platform. What happens next The restriction is temporary. We will re-enable these capabilities once the fix is deployed and will notify you when that happens. What you need to do No action is required on your side. We apologize for the inconvenience and appreciate your understanding.

2. monitoring Oct 21, 2026, 09:11 AM UTC

   The support form in the console is also affected. In order to reach Bitdefender Support, use any of the channels listed here: bitdefender.com/business/support/en/71263-463883-how-to-open-a-case-with-bitdefender-enterprise….

3. monitoring Oct 21, 2026, 11:04 AM UTC

   The sample submission functionality is disabled too

4. resolved Oct 21, 2026, 06:48 PM UTC

   All GravityZone Cloud instances have been updated with the patched PHP version. All mitigations are now removed. Thank you for your continuous trust.