PHP Security Vulnerabilities (October 2026)

This article describes how Cintoo addressed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, published on October 21, 2026.

What Happened

On October 21, 2026, PHP published two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They could allow an unauthenticated attacker to run code remotely on a server using an affected PHP version.

Cintoo platform uses PHP, so Cintoo treated these vulnerabilities as a top priority.

Measures Taken

• Cintoo platform was upgraded to patched PHP version 8.4.27.
• Update was deployed to all production regions (Europe, US and Canada) on October 21, 2026 at 17:23 UTC, same day PHP released its fix.
• Platform has been monitored since update and is running normally.

Data Security

• Cintoo investigated and found no attempt to exploit these vulnerabilities against its platform.
• Security of your data has not been compromised: no customer data was affected and there was no service outage.

Impact on Customers

• All Cintoo accounts received fix, whatever region they are hosted in.
• No action is needed on your side.
• Update does not change how Cintoo works.

For any question, contact support@cintoo.com.