Published: 21 October 2026
In response to the recently disclosed critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, which could potentially allow unauthorized remote code execution on affected systems.
We have taken immediate action to address them.
Scope and impact
Our use of PHP was limited to our public-facing website. Our software products, development tools, and customer environments do not depend on the affected PHP runtime.
We have no indication that our website has been compromised or that unauthorized access has occurred in connection with these vulnerabilities.
Remediation
Immediately following the availability of the relevant security updates on 21 October 2026, we updated the PHP environment used by our website to address the reported vulnerabilities.
Customer impact and business continuity
All business operations and customer services continue as normal. We do not anticipate any disruption to service availability or business continuity resulting from these vulnerabilities.
Ongoing security
Security remains an ongoing priority. We continue to monitor relevant security advisories and apply updates to maintain the security and reliability of our infrastructure.
Should any new information materially change our assessment of the mentioned CVEs, we will update this statement accordingly.
Remain Software
21 October 2026
