Announcing: Futurae unaffected by PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

No action required.

We are aware of the two critical PHP vulnerabilities disclosed on October 21, 2026:

• CVE-2026-109618 – Remote code execution via out-of-memory (OOM) corruption
• CVE-2026-109619 – Remote code execution via stale global state

We want to reassure our customers that Futurae was not affected by these issues. Futurae’s Services do not utilize PHP, neither in our internal infrastructure nor in our backend applications.

Additionally, none of our critical suppliers have been impacted in a way that affected our ability to provide the Futurae Service to our customers, or that resulted in exposure of customer data.

Customers who run PHP in their own environments are strongly encouraged to upgrade to the latest patched PHP release as soon as possible.

As part of our monitoring and incident response processes, we are committed to reacting swiftly should any such vulnerability affect our systems and applications, as well as promptly notifying all our customers if action is needed on their side.

Futurae systems and services remain fully operational.

Should you have any questions or concerns, please do not hesitate to contact our support team at support@futurae.com.