Resolved on October 22, 2026, affecting Scheduler and API.
Cronofy are aware of two recently published PHP vulnerabilities, CVE-2026-109618 & CVE-2026-109619. We can confirm that we do not make use of PHP and are therefore unaffected by these vulnerabilities. Regarding usage of our PHP SDK, we strongly recommend that you upgrade to a version of PHP that includes patches for the two identified vulnerabilities. For further reading please refer to PHP’s documentation: https://www.php.net/archive/2026.php#2026-10-21-5 Please contact [email protected] with any questions.
Affected components
Update timeline
- resolved Oct 22, 2026, 12:01 PM UTC
Cronofy are aware of two recently published PHP vulnerabilities, CVE-2026-109618 & CVE-2026-109619. We can confirm that we do not make use of PHP and are therefore unaffected by these vulnerabilities. Regarding usage of our PHP SDK, we strongly recommend that you upgrade to a version of PHP that includes patches for the two identified vulnerabilities. For further reading please refer to PHP’s documentation: https://www.php.net/archive/2026.php#2026-10-21-5 Please contact [email protected] with any questions.
Your product runs on more than Cronofy
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services