--- title: "Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)" description: Read the Clearooms security response regarding critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. All systems are fully patched and no customer action is required. --- [Skip to content](https://knowledgebase.clearooms.com/critical-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619#main-content) ![Colour Transparent](https://knowledgebase.clearooms.com/hs-fs/hubfs/Colour%20Transparent.png?width=1672&height=313&name=Colour%20Transparent.png) Open main navigation Close main navigation - [Contact us](https://2feg9n.share-eu1.hsforms.com/2LEUbrOfJTIe01qcEQusU5w) [Contact us](https://2feg9n.share-eu1.hsforms.com/2LEUbrOfJTIe01qcEQusU5w) How can we help you? - There are no suggestions because the search field is empty. 1. [Clearooms Knowledge Base](https://knowledgebase.clearooms.com/?hsLang=en-gb) 2. [Security](https://knowledgebase.clearooms.com/security?hsLang=en-gb) # Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) ## RESOLVED: Issued 22 October 2026 · Applies to the Clearooms platform On 21 October 2026 the PHP Foundation disclosed two critical security vulnerabilities in PHP, the programming language that runs much of the Clearooms platform. We want to let you know how this affects your Clearooms service, what we found, what we did and what it means for you. In short, we were in scope, we patched every affected system on the day the fixes were released, and we found no sign that anyone tried to exploit the vulnerabilities against us. Your data was protected throughout, and you do not need to do anything. ### **At a glance** - We use PHP, so we were in scope for these vulnerabilities. - We patched every PHP system we run on 21 October 2026, the day the fixes were published, and had interim mitigations in place before that. - We found no signs of compromise, and no customer data was affected. - You do not need to take any action. ### **About the vulnerabilities** The PHP Foundation rates both vulnerabilities 9.2 (Critical) on CVSS v4.0. Both allow remote code execution from unauthenticated requests, which means an attacker could potentially run code on an unpatched server without logging in. The PHP Foundation fixed them in the releases below. ![Screenshot at Oct 22 09-53-21](https://knowledgebase.clearooms.com/hs-fs/hubfs/Screenshot%20at%20Oct%2022%2009-53-21.png?width=670&height=189&name=Screenshot%20at%20Oct%2022%2009-53-21.png) ### **What we did** #### **Where we use PHP?** PHP is the main server-side language for our platform. It powers our web application and API (including your dashboard and integrations), our real-time notification service, background job processing and a small number of internal tools. We run all of these on infrastructure we operate ourselves in AWS. Because the web application, API and background processing handle and store your data, we treated this as a priority from the moment the vulnerabilities were announced. #### **We patched every PHP system on the day of release** We updated every PHP instance on 21 October 2026, the day the fixes were published. They now run PHP 8.2.35, 8.3.36 or 8.4.27, using the patched packages from the official Debian/Ubuntu PHP package maintainer. Before the fixed packages were available, we applied the PHP project's recommended interim mitigations across all our PHP systems. #### **No third-party hosting or products were involved** We manage all of our PHP workloads ourselves, so we patched them directly rather than waiting on a provider. We do not use managed PHP hosting, and we are not aware of any third-party products in our environment that bundle PHP. Our public marketing website is a static site and does not run PHP. #### **We run only supported, fixed versions** Every PHP instance we run is on a supported, fixed release. We do not run PHP 8.1 or earlier in production. We had already retired and replaced the older servers that ran end-of-life PHP versions before the fix was released. #### **We checked for signs of compromise and found none** From before the security release until every system was patched, we continuously monitored all of our internet-facing PHP systems for signs of exploitation. We looked for PHP process crashes, unexpected processes spawned by the web server, new or modified executable files in web and temporary directories, unexpected listening services and abnormal error rates. We found no indicators of compromise, so we did not need to invoke our incident response procedures. This monitoring continues as part of our normal operations. #### **What this means for you** Your Clearooms service and data were protected throughout. You do not need to change, update or reset anything. If anything about our assessment changes, we will contact you directly.  We take the security of your data seriously, and we want you to have full confidence in how we protect it. If you need further evidence for your own supplier assurance process, or have any questions at all, please reply to us or contact your account manager, and we will be happy to help. - [FAQs](https://knowledgebase.clearooms.com/faqs?hsLang=en-gb#main-content) - [General](https://knowledgebase.clearooms.com/faqs?hsLang=en-gb#general) - [Hosting & Security](https://knowledgebase.clearooms.com/faqs?hsLang=en-gb#hosting-security) - [Desk Booking](https://knowledgebase.clearooms.com/faqs?hsLang=en-gb#desk-booking) - [Meeting Rooms](https://knowledgebase.clearooms.com/faqs?hsLang=en-gb#meeting-rooms) - [Getting started](https://knowledgebase.clearooms.com/getting-started?hsLang=en-gb) - [General](https://knowledgebase.clearooms.com/general?hsLang=en-gb#main-content) - [Troubleshooting](https://knowledgebase.clearooms.com/general?hsLang=en-gb#troubleshooting) - [Desks](https://knowledgebase.clearooms.com/general?hsLang=en-gb#desks) - [Meeting Rooms](https://knowledgebase.clearooms.com/general?hsLang=en-gb#meeting-rooms) - [Admin Settings](https://knowledgebase.clearooms.com/general?hsLang=en-gb#admin-settings) - [Planning](https://knowledgebase.clearooms.com/general?hsLang=en-gb#planning) - [Reports](https://knowledgebase.clearooms.com/reports?hsLang=en-gb) - [Settings](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#main-content) - [Users](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#users) - [Desk Settings](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#desk-settings) - [Meeting Room Settings](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#meeting-room-settings) - [Room Display App Settings](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#room-display-app-settings) - [Services](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#services) - [Account Settings](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#account-settings) - [Event Management](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#event-management) - [Visitor Management](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#visitor-management) - [Custom Fields](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#custom-fields) - [Multi-Factor authentication](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#multi-factor-authentication) - [Manager Settings](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#manager-settings) - [Billing](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#billing) - [Status](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#status) - [Apps](https://knowledgebase.clearooms.com/settings?hsLang=en-gb#apps) - [Support](https://knowledgebase.clearooms.com/support?hsLang=en-gb) - [Security](https://knowledgebase.clearooms.com/security?hsLang=en-gb#main-content) - [SSO, SCIM Apps & Integrations](https://knowledgebase.clearooms.com/security?hsLang=en-gb#sso-scim-apps-integrations) - [Privacy](https://knowledgebase.clearooms.com/security?hsLang=en-gb#privacy) - [Desk Booking App](https://knowledgebase.clearooms.com/desk-booking-app?hsLang=en-gb) - [Room Display App](https://knowledgebase.clearooms.com/room-display-app?hsLang=en-gb) - [Video Tutorials](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#main-content) - [Getting Started With Clearooms](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#getting-started-with-clearooms) - [Clearooms Desk Booking App: Getting Started With Clearooms](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#clearooms-desk-booking-app-getting-started-with-clearooms) - [Desks](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#desks) - [Meeting Rooms](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#meeting-rooms) - [Smart Booking And Favourites](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#smart-booking-and-favourites) - [Clearooms Room Display App](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#clearooms-room-display-app) - [Apps And Integrations](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#apps-and-integrations) - [Users](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#users) - [Office Plan](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#office-plan) - [Desk Neighbourhoods & Meeting Zones](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#desk-neighbourhoods-meeting-zones) - [My Bookings](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#my-bookings) - [Services](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#services) - [Kiosk](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#kiosk) - [Custom Fields](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#custom-fields) - [Who's In](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#whos-in) - [Status](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#status) - [Help Centre](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#help-centre) - [OpenSpaces](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#openspaces) - [Parking Spaces](https://knowledgebase.clearooms.com/video-tutorials?hsLang=en-gb#parking-spaces) - [OpenSpaces](https://knowledgebase.clearooms.com/openspaces?hsLang=en-gb) - [Parking Spaces](https://knowledgebase.clearooms.com/parking-spaces?hsLang=en-gb#main-content) - [Parking Misuse Reporting](https://knowledgebase.clearooms.com/parking-spaces?hsLang=en-gb#parking-misuse-reporting) [![Colour Transparent](https://knowledgebase.clearooms.com/hs-fs/hubfs/Colour%20Transparent.png?width=1672&height=313&name=Colour%20Transparent.png "Colour Transparent")](http://clearooms.com) [mailto:support@clearooms.com](mailto:support@clearooms.com) Copyright © 2025, clearooms.com