Security Update: PHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Incident Report for Push Operations

Resolved

On October 21, the PHP project disclosed two critical vulnerabilities affecting all PHP-based applications. Push applied protective mitigation immediately and completed patching of all production servers the same day. We have found no indication that the vulnerabilities were exploited against our platform. No customer action is required.

Posted Oct 21, 2026 - 22:44 UTC

This incident affected: Push Web App and Platform API.