On 21 October 2026, two critical vulnerabilities in the PHP programming language were publicly disclosed (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2).
Immediately after news of leaks surfaced [1] prior to the scheduled patch release, the store was taken offline as a precautionary measure and was not reactivated until after the security update had been applied to a secure version of PHP. Based on a forensic analysis of the relevant logs and integrity checks, no signs of a compromise were found.
No action is required. If you have any questions, please use the contact form.
References