WISEflow incident
Statement on the PHP vulnerabilities disclosed on the 21st of October 2026
Resolved on October 21, 2026, affecting Main application and Main application (Main application — FLOWoral) and 1 more.
At 16:00 CEST PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The time of disclosure was announced on the 20th of October, so the UNIwise Product team was aware of the incoming disclosure and was prepared and waiting at the time. WISEflow uses PHP in some of its services, and we identified that they were exposed to the vulnerabilities. WISEflow Originality does not use PHP. We started multiple mitigation paths in parallel, one track to update to the patched versions of PHP, and one track to prevent the known exploitation paths of the vulnerabilities. We deployed this initial mitigation at 17:34 CEST and significantly reduced our exposure, if not removing it entirely. While the PHP patches were released at 16:00 CEST, the corresponding Docker images that we and many others depend on were not ready yet and did not become available until 18:02 CEST. With the Docker images available, we started the work to upgrade our services, which was initially inhibited by the significant load on the PHP ecosystem caused by everyone trying to pull updates at the same time globally. At 20:20 CEST all WISEflow environments have been patched with the latest version of PHP. We have no indication that the vulnerabilities have been exploited.
Affected components
Update timeline
- resolved Oct 21, 2026, 07:18 PM UTC
At 16:00 CEST PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The time of disclosure was announced on the 20th of October, so the UNIwise Product team was aware of the incoming disclosure and was prepared and waiting at the time. WISEflow uses PHP in some of its services, and we identified that they were exposed to the vulnerabilities. WISEflow Originality does not use PHP. We started multiple mitigation paths in parallel, one track to update to the patched versions of PHP, and one track to prevent the known exploitation paths of the vulnerabilities. We deployed this initial mitigation at 17:34 CEST and significantly reduced our exposure, if not removing it entirely. While the PHP patches were released at 16:00 CEST, the corresponding Docker images that we and many others depend on were not ready yet and did not become available until 18:02 CEST. With the Docker images available, we started the work to upgrade our services, which was initially inhibited by the significant load on the PHP ecosystem caused by everyone trying to pull updates at the same time globally. At 20:20 CEST all WISEflow environments have been patched with the latest version of PHP. We have no indication that the vulnerabilities have been exploited.
Your product runs on more than WISEflow
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services