Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

Update timeline

1. investigating Oct 21, 2026, 03:03 PM UTC

   Akamai is aware of the recently published remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-10961). Our subject matter experts are actively investigating and taking the appropriate measures. We have released security updates to address these CVEs and monitor for exploitation attempts. We are actively monitoring our platform while we perform the mitigation actions. If you have questions or are experiencing an impact due to this issue, please use the Support Center on Akamai Community (https://community.akamai.com/customers/s/support), or Akamai Control Center, to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.

2. investigating Oct 22, 2026, 01:44 AM UTC

   We are continuing to assess the reported vulnerabilities (CVE-2026-109618 and CVE-2026-10961) across our systems and applications. Our initial assessment has identified systems and applications that may be affected, and remediation efforts, including patching, are actively underway.At this time, we have found no evidence indicating that these vulnerabilities have impacted our products, API calls, or Control Center. We will continue to review our systems and applications to assess potential exposure and identify any additional remediation requirements.Mitigation efforts are being prioritized based on the assessment of potential risk and impact. We remain focused on addressing identified vulnerabilities and will provide further updates as additional information becomes available. We will provide further updates as we make progress.

3. identified Oct 22, 2026, 06:15 PM UTC

   Update - We are continuing to assess the reported vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our systems and applications. Our initial assessment has identified systems and applications that may be affected, and remediation efforts, including patching, are actively underway.At this time, we have found no evidence indicating that these vulnerabilities have impacted our products, API calls, or Control Center. We will continue to review our systems and applications to assess potential exposure and identify any additional remediation requirements. Mitigation efforts are being prioritized based on the assessment of potential risk and impact. We remain focused on addressing identified vulnerabilities and will provide further updates as additional information becomes available. We will provide further updates as we make progress.

4. resolved Oct 23, 2026, 08:18 PM UTC

   We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these vulnerabilities impacted Akamai products, API calls, or Control Center. Customers and partners can view additional details by logging in to Control Center or contacting Akamai Support.We apologize for any concern this advisory may have caused and thank you for your patience and continued support. We remain committed to improving our systems and reducing the risk of similar issues in the future.