CVE-2026-109618 and CVE-2026-109619

Date Time Description
21 October 2026 13:50 UTC Pexip has completed our evaluation of the risk to Pexip Infinity and the Pexip Services related to the recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We have determined that neither Pexip Infinity nor the Pexip Services uses PHP, and that neither is affected by these CVEs. Customers can review the software packages included in Pexip Infinity in the licenses list in our documentation. Please contact your Pexip representative or support@pexip.com for further details.
21 October 2026 13:33 UTC Pexip Engineering confirmed that Pexip Infinity does not use PHP.
21 October 2026 07:42 UTC Pexip is aware of the recently disclosed PHP vulnerabilities and is actively investigating whether its products and services are affected.