Upstream Works Statement on PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Upstream Works Software Ltd. is aware of the two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, publicly disclosed by the PHP project on October 21, 2026.
After review by our engineering and security teams, we have confirmed that no Upstream Works products or cloud services are affected by these vulnerabilities. Our products do not use the PHP runtime, and no PHP components are included in our software, our hosted environments, or the third-party components we embed. No action is required by Upstream Works customers in relation to our products.
Upstream Works continuously monitors security advisories affecting the technologies in our supply chain, and we will update this notice if new information comes to light. Customers with questions may contact their Upstream Works account representative or our support team at support@upstreamworks.com.