ACTION REQUIRED - Critical PHP Vulnerabilities

Update timeline

1. identified Oct 21, 2026, 07:38 PM UTC

   Opti9 is aware of recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may allow remote code execution under certain conditions. Our engineering teams are actively reviewing all infrastructure components and implementing appropriate mitigations and patches to address the CVE. In parallel, we are coordinating with our vendors and contractors to ensure any required remediation is identified and addressed. If any of your applications use PHP, we strongly recommend reviewing them as soon as possible. If you are unable to patch promptly, we recommend considering whether the affected application should be taken offline until it can be updated. Additional Resources • Official PHP advisory: https://www.php.net/index.php#2026-10-20-1 • Proof of concept exploit: https://jackalsyn.com/posts/php-up-2026.html • CVE-2026-109618 and CVE-2026-109619 We will continue to monitor the situation and share updates as needed. Regards, The Opti9 Team

2. identified Oct 21, 2026, 11:57 PM UTC

   Many of our clients are running pfSense firewall appliances (both virtual and physical) that are impacted by the vulnerability. If you are running a pfSense virtual or physical appliance, it is crucial that you mitigate or eliminate exposure to this vulnerability being exploited. We recommend that you take the following actions immediately: 1. Restrict management access to trusted networks (or disable Web Management entirely) https://docs.netgate.com/pfsense/en/latest/recipes/remote-firewall-administration.html 2. Review and consider updating and/or patching your pfSense instance and follow guidelines and recommendations from the software manufacturer (Netgate) https://www.netgate.com/blog/critical-php-security-update