Critical vulnerabilities in PHP

Incident Report for Teams Connector

Resolved

On October 21, 2026, two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were publicly disclosed. Our security team assessed all of our systems as soon as the advisory was released.

None of our critical systems were affected. A limited number of non-critical systems were running affected PHP versions; these have been updated to patched releases and are fully remediated. We have found no evidence that these vulnerabilities were exploited in our environment.
No action is required from customers. Service availability was not impacted. If you have any questions, please contact our support.

Posted Oct 23, 2026 - 11:57 EDT