Pica9 completed patching its servers against the recently disclosed critical PHP vulnerabilities as of 10:30 a.m. Eastern on Monday, October 26, 2026.
We are sharing this update to give our customers and the broader public a clear account of our response.
What happened
Last week, the PHP project disclosed two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these vulnerabilities could allow an attacker to execute unauthorized code on an affected server. PHP released security patches on October 21.
How Pica9 responded
Our response began Tuesday afternoon, October 20, when we learned of the impending security release. Our infrastructure team assessed the potential exposure of our environment and began reviewing logs for signs of unexpected or malicious activity.
On Wednesday, October 21, we implemented additional configuration safeguards to substantially reduce exposure to an exploit, while preparing and testing security patches. Following testing, we completed patching across our servers at 10:30 a.m. Eastern on October 26. Throughout this work, we provided customers with updates on our assessment, protective measures, and progress toward remediation.
Continuing vigilance
We will continue monitoring our environment and reviewing subsequent PHP security advisories for any additional action required.
We appreciate our customers’ patience and the constructive engagement of their technology and security teams throughout this response. Customers with questions should contact their Pica9 customer success representative.
