PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619) – Update

Update timeline

1. investigating Oct 21, 2026, 02:49 PM UTC

   We are performing emergency maintenance to address an issue affecting PHP. During this maintenance, some services may experience brief interruptions or temporary unavailability. We are working to complete the maintenance as quickly as possible and will provide updates as needed. Thank you for your patience and understanding.

2. investigating Oct 21, 2026, 04:56 PM UTC

   On 21 October 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Our teams began remediation immediately. We have applied the patched PHP versions to the large majority of our internet-facing infrastructure and restarted the affected services. Remediation of the remaining systems is in progress, and we are applying additional protective measures where updates are not yet available from upstream providers. We have found no evidence of exploitation affecting our platform, and investigation is ongoing. No customer action is required at this time. We will post another update once remediation is complete.

3. resolved Oct 22, 2026, 09:24 AM UTC

   Remediation of the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 is complete for all internet-facing Productsup services. All affected services have been updated to patched PHP releases and restarted. Our investigation found no evidence that these vulnerabilities were exploited against our platform. We continue to monitor our systems. No customer action is required. This incident is now resolved.