Resolved after 9 hours 14 minutes, on October 21, 2026.
We have completed patching our Enterprise and Self-Serve infrastructure for CVE-2026-109618 and CVE-2026-109619. We were able to do so without any disruptions to the service. We continue to monitor our infrastructure. We can confirm that between the time we sent the email and the patch being fully deployed, we saw no signs that they were exploited against Geocodio.
Update timeline
- monitoring Oct 21, 2026, 09:14 AM UTC
Geocodio runs on PHP, and PHP has announced two critical security vulnerabilities. We have seen no sign of exploitation, and all services are running normally. Patches are expected today at 14:00 UTC (10AM US Eastern). We will deploy the patch as soon as it's available. To protect customer data, there is a chance we may temporarily pause spreadsheet uploads in the dashboard and through the Lists API until the patch is in place. Geocoding API requests will not be affected. We'll update this page if we pause uploads.
- resolved Oct 21, 2026, 06:29 PM UTC
We have completed patching our Enterprise and Self-Serve infrastructure for CVE-2026-109618 and CVE-2026-109619. We were able to do so without any disruptions to the service. We continue to monitor our infrastructure. We can confirm that between the time we sent the email and the patch being fully deployed, we saw no signs that they were exploited against Geocodio.
Your product runs on more than Geocodio
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services