Ongoing since 03:26 PM UTC, affecting BLOX CMS and BLOX VMS and 1 more.
On Tuesday, October 20, the PHP Group disclosed two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Details are in the PHP announcement: https://www.php.net/archive/2026.php#2026-10-21-5 We moved quickly to protect our customers. At 9:00 PM CDT on Tuesday, we applied mitigations across our BLOX, Rayos, and VMS platforms. We also added monitoring and detection rules to identify attempts to exploit these vulnerabilities. The PHP Group released official fixes at 9:00 AM CDT on Wednesday, October 21, and our systems team then deployed those fixes to BLOX, Rayos, and VMS. Based on our review, we have found no evidence of exploitation attempts on our platforms before the mitigations were in place. We will continue to monitor the situation and will share updates if anything changes. No action is required on your part. If you have questions, please contact our support team.
Affected components
Update timeline
- monitoring Oct 22, 2026, 03:26 PM UTC
On Tuesday, October 20, the PHP Group disclosed two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Details are in the PHP announcement: https://www.php.net/archive/2026.php#2026-10-21-5 We moved quickly to protect our customers. At 9:00 PM CDT on Tuesday, we applied mitigations across our BLOX, Rayos, and VMS platforms. We also added monitoring and detection rules to identify attempts to exploit these vulnerabilities. The PHP Group released official fixes at 9:00 AM CDT on Wednesday, October 21, and our systems team then deployed those fixes to BLOX, Rayos, and VMS. Based on our review, we have found no evidence of exploitation attempts on our platforms before the mitigations were in place. We will continue to monitor the situation and will share updates if anything changes. No action is required on your part. If you have questions, please contact our support team.
Your product runs on more than BLOX Digital
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services