Kaseya incident
PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): Kaseya status - Investigation and Remediation
Resolved after 20 hours 43 minutes, on October 21, 2026.
Two critical vulnerabilities in PHP allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none
Update timeline
- investigating Oct 21, 2026, 09:51 PM UTC
Two critical vulnerabilities in PHP allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none
Your product runs on more than Kaseya
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services