PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)
Timeline · 2 updates
- identified Oct 21, 2026, 03:08 PM UTC
We are aware of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed today. PHP is in use on our platform, and our Security and DevOps teams are actively working on this. We are testing the recommended PHP configuration change as a temporary protection until the fix is in place. The official PHP security release is expected at 14:00 UTC today. Once released, the fix will be tested before being deployed to production. We will post updates here as each step is completed.
- resolved Oct 21, 2026, 10:42 PM UTC
The PHP 8.4.27 upgrade has been released to all Stova servers, resolving the issue of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).