Ongoing since 08:50 PM UTC, affecting Donate and Volunteer Core Services and Grants Essential (formerly Benevity Grants) and 1 more.
On Oct. 21, 2026, the PHP project released fixes for two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, a programming language used by parts of the Benevity platform. We have found no evidence that any Benevity system or client data has been compromised, and there is no confirmed impact to clients. Our team put mitigations in place shortly after the announcement and have applied updates to the affected components. We continue to monitor our systems for signs of attempted exploitation. No further action required at this time. More updates will follow as they become available.
Affected components
Update timeline
- monitoring Oct 22, 2026, 08:50 PM UTC
On Oct. 21, 2026, the PHP project released fixes for two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, a programming language used by parts of the Benevity platform. We have found no evidence that any Benevity system or client data has been compromised, and there is no confirmed impact to clients. Our team put mitigations in place shortly after the announcement and have applied updates to the affected components. We continue to monitor our systems for signs of attempted exploitation. No further action required at this time. More updates will follow as they become available.
Your product runs on more than Benevity
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services