Chameleon.io incident

Chameleon response to PHP CVE-2026-109618 and CVE-2026-109619

Notice Vendor's status page →

Resolved on October 22, 2026.

resolved Oct 23, 2026, 01:02 PM UTC

Chameleon does not use PHP in our stack that supports Chameleon customers and end-users. Chameleon does use PHP in conjunction with Statamic CMS for our marketing site and we have upgraded to the patched PHP version 8.2.35 as of 2026-10-22T17:35:00 UTC.

Started
Oct 22, 2026, 05:30 PM UTC
Resolved
Oct 22, 2026, 05:30 PM UTC
Duration
–
Detected by Pingoru
Oct 22, 2026, 05:30 PM UTC

Update timeline

  1. resolved Oct 23, 2026, 01:02 PM UTC

    Chameleon does not use PHP in our stack that supports Chameleon customers and end-users. Chameleon does use PHP in conjunction with Statamic CMS for our marketing site and we have upgraded to the patched PHP version 8.2.35 as of 2026-10-22T17:35:00 UTC.

Your product runs on more than Chameleon.io

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.

Cloudflare Amazon Web Services Twilio Stripe Slack Okta Figma GitHub Datadog Vercel OpenAI Google Cloud
Add your stack →