Update on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Last updated: 22 October 2026, 12:00 CEST
On October 20, 2026, details emerged of two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution without authentication. The PHP project released fixes on October 21, 2026, and exploitation attempts have been reported across the internet.
Our core platforms do not use PHP. We are investigating any use of PHP across our wider infrastructure, supporting services, and internal tooling, including our Azure and AWS environments, to determine whether any systems are affected. Where affected versions are found, we are applying the patched PHP releases and verifying that each fix is in place.
Customer impact: We have identified no evidence of impact on customer environments or data. Our investigation remains ongoing. No customer / user action is required at this time. If necessary we will contact affected customers directly if we identify any impact or required action.
We will update this page as our findings develop.