Cloudinary incident
Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Resolved on October 21, 2026.
Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core platform, including its upload, transformation, and delivery APIs and Console, does not use PHP and is not affected by these vulnerabilities. Please note that customers who use the Cloudinary PHP SDK in their own applications should update PHP in their respective environments
Update timeline
- resolved Oct 21, 2026, 06:22 PM UTC
Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core platform, including its upload, transformation, and delivery APIs and Console, does not use PHP and is not affected by these vulnerabilities. Please note that customers who use the Cloudinary PHP SDK in their own applications should update PHP in their respective environments
Your product runs on more than Cloudinary
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services