Aurascape Security Update: Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Aurascape’s assessment confirms that customer environments are unaffected by the critical PHP vulnerabilities. Our corporate website and relevant third-party services have been patched, with no evidence of compromise identified.
October 22nd, 2026
Aurascape confirms that its customer environments are not affected, its corporate website has been fully patched, and all relevant third-party services have received the necessary security updates. No evidence of compromise has been identified.
On October 21, 2026, the PHP development team released critical security updates addressing two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute malicious code on vulnerable web servers.
Aurascape has completed its security assessment and confirmed that our customer-facing platform and services were not impacted. Our corporate website has also been updated to the latest patched version of PHP 8.3, with no unusual activity or indications of compromise observed.
Understanding the Vulnerabilities
The two vulnerabilities, collectively referred to as PHP2Shell, affect the PHP runtime and carry critical severity ratings.
- CVE-2026-109618: An out-of-memory handling vulnerability that can corrupt partially initialized request data.
- CVE-2026-109619: A vulnerability involving stale internal request state in shared worker memory.
Successful exploitation could allow unauthenticated attackers to execute unauthorized code on affected servers, potentially resulting in unauthorized access, data exposure, or further system compromise.
Given PHP’s widespread use across web infrastructure, organizations operating vulnerable versions should prioritize applying the available security updates.
Aurascape’s Security Assessment and Response
Following the disclosure, Aurascape reviewed the potential impact across our customer environments, corporate website, and relevant third-party services.
Our Findings Confirm:
Customer Environments: Not Affected
Aurascape’s customer environments do not use PHP. As a result, these vulnerabilities do not directly affect our customer-facing platform or services.
Corporate Website: Patched and No Compromise Identified
Aurascape’s corporate website is hosted on Pantheon and operates on PHP 8.3. The website has been updated to PHP 8.3.36, which includes fixes for both vulnerabilities.
We have verified that all website environments, including Development, Test, and Production, are running the patched version.
Our review has identified no unusual activity or indications of compromise associated with these vulnerabilities.
Third-Party Services: Patched
Aurascape has confirmed that all relevant third-party services have applied the necessary security updates.
Based on these findings, Aurascape has identified no security impact to its platform, corporate website, or customer services from these vulnerabilities.
Recommendations for Organizations
Aurascape remains committed to protecting our customers and maintaining a secure, resilient infrastructure.
Our security assessment confirms that customer environments are not directly affected, our corporate website has been patched with no evidence of compromise, and relevant third-party services have completed remediation.
We will continue monitoring emerging security advisories and maintaining appropriate protections across our environment.
References
Aurascape Solutions
- Discover and monitor AI Get a clear picture of all AI activity.
- Safeguard AI use Secure data and compliancy in AI usage.
- Secure Agentic AI Secure how your teams use AI and build AI agents.
- Copilot readiness Prepare for and monitor AI Copilot use.
- Coding assistant guardrails Accelerate development, safely.
- Frictionless AI security Keep users and admins moving.
- AI Governance & Compliance Move from AI policy to enforceable governance.