Trackunit incident
Critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Resolved on October 22, 2026, affecting Trackunit Manager and Trackunit Verify and 1 more.
On October 21, 2026, two critical vulnerabilities were publicly disclosed in the PHP programming language (CVE-2026-109618 and CVE-2026-109619). They can allow unauthenticated remote code execution in affected PHP environments. Our security team began assessing our exposure. We have taken the necessary actions. No action is required from our customers. We will continue to monitor the situation. If anything changes, we will update this page.
Affected components
Update timeline
- resolved Oct 22, 2026, 07:19 AM UTC
On October 21, 2026, two critical vulnerabilities were publicly disclosed in the PHP programming language (CVE-2026-109618 and CVE-2026-109619). They can allow unauthenticated remote code execution in affected PHP environments. Our security team began assessing our exposure. We have taken the necessary actions. No action is required from our customers. We will continue to monitor the situation. If anything changes, we will update this page.
Your product runs on more than Trackunit
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services