Update regarding PHP CVE Vulnerability Disclosure

Update timeline

1. investigating Oct 21, 2026, 04:39 PM UTC

   We are actively monitoring the recently disclosed PHP vulnerabilities (details here: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) and have completed an initial assessment using our Cloud Security Posture Management tooling to inventory our PHP installations, with a focus on identifying internet-reachable exposures. The critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are scheduled to be addressed through an official PHP security update being released on October 21, 2026. Consistent with vendor and industry guidance, we plan to deploy official security updates to affected resources once they become available and are validated. At this time, we have not identified any customer impact related to these vulnerabilities and continue to closely monitor the situation.

2. investigating Oct 21, 2026, 08:50 PM UTC

   Eptura continues to actively monitor the recently disclosed PHP vulnerabilities. We are scanning our environments for potential exposure and taking appropriate steps to reduce internet-reachable exposure. At this time, we have no indication of compromise or customer impact. We will apply applicable security updates as they become available.

3. monitoring Oct 21, 2026, 08:55 PM UTC

   A fix has been implemented and we are monitoring the results.

4. monitoring Oct 22, 2026, 10:26 AM UTC

   Eptura continues to actively monitor the recently disclosed PHP vulnerabilities. We are scanning our environments for potential exposure and taking appropriate steps to reduce internet-reachable exposure. At this time, we have no indication of compromise or customer impact. We will apply applicable security updates as they become available.