PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Incident Report for Stova

Resolved

The PHP 8.4.27 upgrade has been released to all Stova servers, resolving the issue of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Posted Oct 21, 2026 - 18:42 EDT

Identified

We are aware of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed today. PHP is in use on our platform, and our Security and DevOps teams are actively working on this.

We are testing the recommended PHP configuration change as a temporary protection until the fix is in place. The official PHP security release is expected at 14:00 UTC today. Once released, the fix will be tested before being deployed to production.

We will post updates here as each step is completed.

Posted Oct 21, 2026 - 11:08 EDT