Proemion incident
PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Resolved on October 21, 2026.
With regard to the two widely advertised PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 we clarify that Proemion does not use the affected technology in any part of its DataPlatform or ancillary systems. We became aware of the vulnerabilities on Oct 21 13:05 CEST and immediately coordinated internally to assess the risk which was limited to Proemion website. We setup a static copy of the website and then took the services offline until after a patch was provided and installed. Additionally we waited a 12h cooldown time before bringing the website back online. There is no evidence that the vulnerabilities were used successfully against the website. The Proemion website runs on separate infrastructure without any connection to our other services. We release this statement to all customers who might need it for their own purposes.
Update timeline
- resolved Oct 22, 2026, 09:35 AM UTC
With regard to the two widely advertised PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 we clarify that Proemion does not use the affected technology in any part of its DataPlatform or ancillary systems. We became aware of the vulnerabilities on Oct 21 13:05 CEST and immediately coordinated internally to assess the risk which was limited to Proemion website. We setup a static copy of the website and then took the services offline until after a patch was provided and installed. Additionally we waited a 12h cooldown time before bringing the website back online. There is no evidence that the vulnerabilities were used successfully against the website. The Proemion website runs on separate infrastructure without any connection to our other services. We release this statement to all customers who might need it for their own purposes.
Your product runs on more than Proemion
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services