# Security bulletin — PHP web runtime vulnerabilities (October 2026)

**Bulletin ID:** MF-SB-2026-001

**Published:** 2026-10-23 (Europe/Paris)

**Last updated:** 2026-10-23 (Europe/Paris)

**Status:** Final

**Mindflow impact:** Not affected

:::note[Mindflow impact]
The Mindflow platform is **not affected** by CVE-2026-109618 or CVE-2026-109619. Mindflow does not run PHP to deliver
Studio, flow execution, or Mindflow-hosted services. No Mindflow customer action is required for the platform itself.
:::

## Summary

On 20–21 October 2026, the PHP project and national cybersecurity authorities disclosed two critical vulnerabilities in
PHP web runtimes: [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and
[CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). When exploited against an
affected PHP installation that serves web requests, these issues can allow unauthenticated remote code execution.

Mindflow published this bulletin so customers can confirm platform impact quickly while industry patching continues.

## Background

Both issues affect PHP installations that handle HTTP requests (for example through common PHP web server integrations).
Public advisories assign a critical severity (CVSS 9.2) and recommend upgrading to patched PHP releases:

- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35

[CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) and
[CERT-EU](https://www.cert.europa.eu/publications/security-advisories/2026-018/) urge organizations that run PHP on the
internet to patch immediately. End-of-life PHP branches (8.1 and earlier) have no upstream fix and require migration to
a supported, patched release.

This bulletin summarizes the industry advisory for Mindflow customers. It is not a substitute for the official PHP
security advisories linked below.

## Mindflow assessment

- **Platform:** Mindflow builds and operates Studio and Mindflow-hosted automation services without a PHP web runtime.
  The product does not execute customer or Mindflow application code on PHP workers that serve HTTP requests.
- **Customer data and flows:** Flow design, execution, credentials stored in Mindflow, and Studio access are not exposed
  through these PHP vulnerabilities.
- **Integrations:** If your organization runs PHP elsewhere (for example on your own websites, appliances, or
  third-party tools that Mindflow calls), those systems may still be in scope for the public advisories. Follow the
  vendor or owner guidance for those environments. Calling a PHP-based API from a Mindflow flow does not make the
  Mindflow platform vulnerable to these issues.

## Customer action

No action is required on the Mindflow platform.

Optionally, if your security or IT teams manage PHP outside Mindflow, inventory those systems and apply the patched PHP
versions listed in the official advisories. Watch your other vendors’ status and security pages for their own impact
statements.

## References

- [PHP security advisory — RCE via OOM corruption (GHSA-w8hw-w9fx-j79w / CVE-2026-109618)](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- [PHP security advisory — RCE via stale global state (GHSA-6wmf-4rv5-p3rp / CVE-2026-109619)](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [CISA alert — Critical vulnerabilities in PHP require immediate patching](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching)
- [CERT-EU advisory 2026-018 — Critical vulnerabilities in PHP](https://www.cert.europa.eu/publications/security-advisories/2026-018/)
- [AWS security bulletin 2026-143 — PHP web runtimes](https://aws.amazon.com/security/security-bulletins/2026-143-aws/)