PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619) – Update

Update timeline

1. investigating Oct 21, 2026, 02:49 PM UTC

   We are performing emergency maintenance to address an issue affecting PHP. During this maintenance, some services may experience brief interruptions or temporary unavailability. We are working to complete the maintenance as quickly as possible and will provide updates as needed. Thank you for your patience and understanding.

2. investigating Oct 21, 2026, 04:56 PM UTC

   On 21 October 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Our teams began remediation immediately. We have applied the patched PHP versions to the large majority of our internet-facing infrastructure and restarted the affected services. Remediation of the remaining systems is in progress, and we are applying additional protective measures where updates are not yet available from upstream providers. We have found no evidence of exploitation affecting our platform, and investigation is ongoing. No customer action is required at this time. We will post another update once remediation is complete.