CVE-2026-109618 and CVE-2026-109619 do not affect Conduit. No action is needed.
͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏
|
Hi [First name],
|
|
On October 21, 2026, the PHP project disclosed two critical vulnerabilities. On servers that run PHP, they can let an attacker execute code remotely without logging in:
|
|
CVE-2026-109618: remote code execution via out-of-memory corruption (CVSS 9.2)
CVE-2026-109619: remote code execution via stale global state (CVSS 9.2)
|
|
Conduit is not affected. Our platform does not run PHP, so these vulnerabilities do not apply to Conduit or to your data. You don't need to do anything in your Conduit account.
|
If your business runs its own PHP websites or servers, such as a WordPress site, ask your developer or hosting provider to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The official PHP security advisory has the full details.
|
|
If you have any questions, just reply to this email.
|
|
-Punn
|
|
Co-founder at Conduit
|
|
|
|
|
|