Last Updated: October 23, 2026
Summary
On October 21, 2026, the PHP Security Team released patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0: 9.2 each). Variphy software, cloud services, and website are not affected. The Variphy Support Knowledge Base ran an affected PHP version and was patched on October 22, 2026.
Scope
Not affected:
- Variphy software (all versions)
- Variphy cloud services
- Variphy website
Affected and patched on October 22, 2026:
- Variphy Support Knowledge Base
Details
Both vulnerabilities exist in the PHP interpreter itself. Variphy does not use PHP in its software, cloud services, or website, so those have no vulnerable component to exploit. The Variphy Support Knowledge Base runs on WP Engine, which used an affected PHP version. WP Engine upgraded and patched that version on October 22, 2026.
Customer Action
No action is required.
References
- CVE-2026-109618: https://www.cve.org/CVERecord?id=CVE-2026-109618
- CVE-2026-109619: https://www.cve.org/CVERecord?id=CVE-2026-109619
