Conduit
Day 10 after signup
Security advisory: Conduit is not affected by the October PHP vulnerabilities
CVE-2026-109618 and CVE-2026-109619 do not affect Conduit. No action is needed.
Why it works
- Explain the risk briefly, then state clearly whether it affects the recipient's service and whether they need to act.
- Separate advice for customers' own systems from the company's platform, and close with a direct way to ask questions.
How it is built
- Personal greeting
- Vulnerability overview
- Impact reassurance
- External update guidance
- Reply and sender sign-off
Email copy
Hi [First name], On October 21, 2026, the PHP project disclosed two critical vulnerabilities. On servers that run PHP, they can let an attacker execute code remotely without logging in: CVE-2026-109618: remote code execution via out-of-memory corruption (CVSS 9.2) CVE-2026-109619: remote code execution via stale global state (CVSS 9.2) Conduit is not affected. Our platform does not run PHP, so these vulnerabilities do not apply to Conduit or to your data. You don't need to do anything in your Conduit account. If your business runs its own PHP websites or servers, such as a WordPress site, ask your developer or hosting provider to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The official PHP security advisory has the full details. If you have any questions, just reply to this email. -Punn Co-founder at Conduit You are receiving this email because you opted in to receive updates from Conduit AI Conduit AI, 425 California Ave, San Francisco, CA Unsubscribe