PHP security update: vulnerabilities addressed

Security updates completed on release day

On 21 October 2026, PHP published security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. We applied the PHP security updates to all affected Divako-managed platform services that same day, when the fixes became available.

Read the official PHP.net security advisory for more information about these vulnerabilities, affected versions and update guidance.

We also strengthened deployment safeguards to help prevent the affected software versions from being reintroduced.

What our review found

Our review of the available security and application logs found no indications that these vulnerabilities had been exploited against the affected platform services. We continue to monitor for suspicious activity and follow relevant security advisories.

What this means for customers

Customers do not need to take action for these platform updates. They have been handled by Divako.

For gateways and other equipment, applicability depends on the model, firmware and configuration. Their status needs to be confirmed for the specific installation. If you have received a security notice from a supplier, please share it with us along with the gateway model or installation details so we can help establish whether any action is needed.

Security is ongoing work

We monitor security advisories, assess their relevance to our services and prioritise critical updates. This work continues as new information and fixes become available.

You can read more about our approach to access control, data protection and incident handling on our security page.