Trust Center

Summary

On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities in PHP core (CVSS v4.0 9.2 each). Under certain conditions, these vulnerabilities may permit unauthenticated remote code execution in web-serving PHP environments, including where application-level code is current. We initiated a prioritized review of potentially affected systems and are coordinating remediation with responsible technical teams. Available industry reporting indicates exploitation, underscoring the importance of timely updates. Our response emphasizes verified remediation, appropriate protective measures, and continued security monitoring.

Statistics

• 9.2 / 9.2: CVSS v4.0 Base for CVE-2026-109618 CVE-2026-109619 as rated by PHP
• Reported: Exploitation attempts reported by multiple vendors; As of October 22, 2026, neither vulnerability has been identified in publicly available reporting as listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
• Prioritized: Updates and risk reduction for affected systems

Our Exposure

Our review identified PHP installations requiring assessment and remediation. We identified applicable versions and deployment configurations, with priority given to systems that could be accessed from the internet. Where affected systems are identified, the responsible teams are implementing the recommended security updates. Exposure assessments and remediation status will continue to be validated as work progresses. Each customer will be contacted if their product is impacted and will send final communications next week.

The Vulnerabilities

CVE-2026-109618 relates to out-of-memory handling, while CVE-2026-109619 relates to stale internal state across requests. The PHP project identifies web-serving configurations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, as potentially affected. Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older unsupported branches require migration or an appropriately supported vendor fix. The applicability of each vulnerability depends on the PHP version and deployment configuration.

Remediation and Compensating Controls

• Patching: Affected installations are being prioritized for security updates to supported fixed releases, or vendor-supported remedies where applicable.
• Interim controls: Installing a supported fix is the primary remediation. Where immediate updates are not feasible, applicable interim protections may include restricting unnecessary functionality, enforcing appropriate request and memory limits, and limiting network access.
• Detection and threat hunting: Security Operations continues to review relevant security telemetry and indicators associated with these vulnerabilities. The assessment has not identified evidence establishing compromise related to these vulnerabilities in the information reviewed to date. Monitoring and investigation will continue as appropriate, and any confirmed security incident would be managed through established incident response procedures.
• Edge and scope: The review includes PHP runtime components embedded in applications, containers, and third-party technologies, in addition to directly managed services. Teams are validating that updates are applied and protective controls remain in place where required. Where remediation could affect availability, measures are coordinated to protect both service continuity and security.

Supporting Information

• PHP project: official advisory: PHP security advisory; GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
• Government guidance: advisories from CERT-EU 2026-018, the Canadian Centre for Cyber Security AL26-026 and the UK NCSC urge immediate patching.
• Industry threat intelligence: exposure data and response guidance from the Unit 42 threat brief, the Google Cloud and Wiz response and Recorded Future analysis.

Dotmatics' statement on recently disclosed PHP vulnerabilities in CVE-2026-109618 and CVE-2026-109619 can be found here.

Date: 5 December 2025

Dotmatics is providing this update to inform our customers of our investigation and response to two notable and recently disclosed vulnerabilities in the JavaScript ecosystem: CVE-2025-55182 and CVE-2025-66478.

1. CVE-2025-55182 React Server Components

On 3 December 2025 at approximately 4:12 PM ET, we became aware of a publicly disclosed vulnerability affecting certain React server-side packages (CVE-2025-55182). Reference materials are available here:

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

https://nvd.nist.gov/vuln/detail/CVE-2025-55182

Immediately upon becoming aware of this disclosure, we initiated an internal review to evaluate whether any products within our application portfolio incorporate the affected React server-side components.

This review was completed at approximately 6:21 PM ET on 3 December 2025. Based on that assessment, no products within our portfolio were found to use the React server-side components associated with CVE-2025-55182.

2. CVE-2025-66478 Next.js (downstream impact)

At approximately 10:51 PM ET on 3 December 2025, we became aware of CVE-2025-66478 which is a downstream vulnerability impacting Next.js due to its dependency on the components associated with CVE-2025-55182. Reference materials are available here:

https://nextjs.org/blog/CVE-2025-66478

https://nvd.nist.gov/vuln/detail/CVE-2025-66478

Immediately upon becoming aware of this disclosure, we initiated an internal review to evaluate whether any products within our application portfolio incorporate the affected Next.js components.

During our review, we identified that two products in our application portfolio: Luma and Sigma components, used affected Next.js versions.

Remediation

Upon identification of these affected components, we immediately initiated our standard vulnerability response procedures, including patch application, internal testing, quality verification, and deployment. All remediation activities were completed by 4 December 2025.

Our monitoring to date has not identified any indicators of abnormal, anomalous, or unauthorized activity associated with these vulnerabilities in the context of our products or environments.

We note that vulnerabilities of this nature may evolve as additional security research becomes available. Accordingly, we will continue to monitor for updates and will take further action as necessary.

3. Customer Guidance

No customer action is required at this time with respect to our products that incorporated the affected Next.js components. If new information becomes available that changes required customer actions or materially impacts risk, we will issue updated communication.

For questions or additional information, please contact your account representative.

There have been many first hand and media reports regarding a high risk, high impact vulnerability in MOVEit file transfer software leading to compromise and ransomware attacks across multiple industries. A recent update from CISA can be found here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

Dotmatics has done a review of implemented software across the organisation and can confirm that we do not run this software, and are not impacted by this vulnerability.

Welcome to Dotmatics' Trust Center. We are pleased to announce the launch of our customer-facing, self-service home for documents and answers on security, privacy, and compliance matters. We will also use this Trust Center as a place to provide confirmed information to customers when it's critical that you know the origin is authentic.