Security advisory
PHP CVE-2026-109618 and CVE-2026-109619: Aetopia not affected
Published October 22, 2026
| CVEs | CVE-2026-109618 CVE-2026-109619 |
|---|---|
| Impact on Aetopia | Not affected. No action needed. |
| Product | PHP (third-party software) |
| Problem type | CWE-416: use after free, with related memory-handling weaknesses |
| Affected versions | PHP 8.2 earlier than 8.2.35, 8.3 earlier than 8.3.36, 8.4 earlier than 8.4.27 and 8.5 earlier than 8.5.12 |
| Fixed in | PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 |
What the vulnerabilities are
On 21 October 2026 the PHP project published two vulnerabilities in PHP itself. Each can lead to remote code execution on a server running an affected PHP version.
- CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup may then treat the invalid data as valid.
- CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.
Is the platform impacted?
No. Aetopia DAMS and Aetopia AI Redact are both built on Java and run as Docker containers. The supporting components (search, message queue, antivirus scanning, reporting and database) do not use PHP either.
Actions and mitigation timeline
None needed.
Service outage
None.
Internal systems
None of our internal systems use PHP. Our support ticketing and email run on Atlassian and Google cloud services, and support continues as normal.
References
- CVE-2026-109618 on cve.org
- CVE-2026-109619 on cve.org
- PHP security advisory for CVE-2026-109618
- PHP security advisory for CVE-2026-109619
Revision history
- 22 October 2026: first published.
Questions about this advisory?
If you want to check which version you’re running or talk through this advisory, get in touch and we’ll get back to you within one business day.