Resolved on October 21, 2026.
Simployer are fully aware of the vulnerability exposed in PHP, and we have taken measures so that our systems are not exposed. Employee Surveys is the only product in the Simployer stack that use PHP. We were eagerly awaiting the patch from PHP and we released the patch to production at 19:05 on Oct. 21st. Employee Surveys production currently runs PHP 8.4.27. It is served by Apache in containers on Kubernetes, hosted in Microsoft Azure within the EU, behind Cloudflare. We have not identified indicators of exploitation of CVE-2026-109618 or CVE-2026-109619.
Update timeline
- resolved Oct 22, 2026, 10:52 AM UTC
Simployer are fully aware of the vulnerability exposed in PHP, and we have taken measures so that our systems are not exposed. Employee Surveys is the only product in the Simployer stack that use PHP. We were eagerly awaiting the patch from PHP and we released the patch to production at 19:05 on Oct. 21st. Employee Surveys production currently runs PHP 8.4.27. It is served by Apache in containers on Kubernetes, hosted in Microsoft Azure within the EU, behind Cloudflare. We have not identified indicators of exploitation of CVE-2026-109618 or CVE-2026-109619.
Your product runs on more than Simployer
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services