On October 22 we became aware of the critical vulnerabilities associated with PHP (CVE-2026-109618 and CVE-2026-109619). We have assessed our risk exposure, developed mitigation plans, and remediation of the issues is in progress.
We are taking this very seriously: We have sought advice from third-party partners, committed additional internal resources, and brought together experts from across the organization to support remediation.
We are confident that there is no negative impact to customers at this time, and customers do not need to take any action with respect to our products and services.
We will provide further updates via our Trust Center and customer care teams.
Our mitigation and remediation plans are as follows:
Risk assessment
- We are conducting daily scans of our cloud environments, perimeter facing assets, and data centers
- We have identified some products with the PHP vulnerability in them.
Mitigation approach
- We have implemented detection and prevention policies across our firewalls
- We have confirmed endpoint detection and response agents are deployed to impacted systems
- We have confirmed logging of impacted systems within our Security Operations Center for monitoring and detection
- Enhanced monitoring and alerting is in place for impacted systems
- Continued validation of risk exposure is in place with third-party software and services providers.
Remediation
- We are now implementing scanning of vulnerabilities and patching
- We have confirmed third-party website hosting providers have remediated vulnerable versions of PHP and updated policies on firewalls.
