Critical PHP vulnerabilities - customer action may be required

Update timeline

1. monitoring Oct 21, 2026, 01:04 PM UTC

   Aptible is aware of the vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP applications that can allow for remote code execution under certain conditions. *Aptible Platform Impact* Aptible has reviewed all infrastructure components that we manage and has confirmed that all are unaffected by this vulnerability. *Customer Application Impact:* Any customer using PHP in their applications is highly encouraged to take action and patch their applications as soon as possible. If you are unable to patch in a timely manner, consider taking your application offline in the interim. Note for the safety of the Aptible platform, we may disable endpoints for applications that show evidence of being exploited by RCE. Aptible provides the platform your application runs on. The PHP runtime version your app uses is controlled by your app's configuration. We cannot patch this for you automatically. Update your PHP version and redeploy as soon as the fixed release is available for your branch. If you need help with these upgrades, reach out to Aptible support. *Additional Resources:* - Official PHP advisory: https://www.php.net/index.php#2026-10-20-1 - Proof of concept exploit: https://jackalsyn.com/posts/php-up-2026.html - CVE-2026-109618, CVE-2026-109619 We will update this notice as the situation develops.