Snyk added a PHP zero-day notice covering CVE-2026-109618 / CVE-2026-109619: critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution, with PHP security updates released October 21. This is relevant to customers running PHP installations serving web requests. The page also removed the Klue incident summary preview, without indicating resolution.
Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.
What changed
Struck in red is what Snyk removed; blue is what they added. Muted text is unchanged context.
BeforeAfter
Added#1
Before: …Privacy Policy and DPA? Updates View all General nothing here General Supply Chain Compromise Incident - Keyv /…
After: …Privacy Policy and DPA? Updates View all General Zero-Day Incident - PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) - Update #1 Published ‹date› Overview On October 21, the PHP project released security updates for two critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution. If you run PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, you should immediately update to one of the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP states that updating is the only safe choice ( PHP security advisory Opens in new tab ). These are vulnerabilities in the PHP runtime itself (the software that runs your applications), not in PHP library dependencies in your application. If you only use Snyk Open Source scanning, you will not see these CVEs in your results. That doesn’t mean you are unaffected. Is Snyk affected? As of this publication, based on the available information, the Snyk environments are not impacted. We are continuing to monitor. What Snyk can show you Snyk Open Source (CLI and SCM integration) analyzes the dependencies your applications declare, so it does not see which PHP runtime is deployed. … General Supply Chain Compromise Incident - Keyv /…
Removed#2
Before: …Update - Third-Party Vendor Security Incident — Klue General Third-Party Vendor Security Incident — Klue Published ‹date›…
Before: …Third-Party Vendor Security Incident — Klue Published ‹date›Summary Snyk is aware of a security incident at Klue, a third-party vendor we use for competitive intelligence. We were notified of a security incident involving Klue, a market intelligence platform used by Snyk and a wide range of companies for competitive intelligence. An unauthorized party accessed data from Snyk's Salesforce environment through Klue's integration. Other security vendors, such as Recorded Future Opens in new tab , Tanium Opens in new tab , Huntress Opens in new tab , and Jamf Opens in new tab have been impacted and have shared updates publicly. Impact on Snyk products and services This incident did not affect Snyk's products, and there was no impact on our ability to serve our customers. The Snyk platform, our scanning engines, and customer-facing services were not involved in any way. Our response After Klue notified us of the incident, we immediately disabled Klue's integration within Salesforce. We have engaged our security team to conduct an independent review, taken steps to protect our environment, and notified law enforcement. We have established the timeline of unauthorized access to our Salesforce environment and are reviewing what data was affected. Wh … . Read more Read more about Third-Party Vendor…
After: …Third-Party Vendor Security Incident — Klue Published ‹date›removed . Read more Read more about Third-Party Vendor…
Compared with the previous archived version (#978 to #5414). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
Snyk’s Trust page now says it is assessing potential impact to its environments and will prioritize remediation of any findings if necessary. The statement does not confirm whether Snyk is affected, so customer exposure remains unconfirmed in this update.
Snyk added a security advisory for Brotli CVE-2026-111497 (CVSS 9.2), recommending updates, restarts and container rebuilds. It clarifies that Open Source scanning misses runtimes; customers should also use Unmanaged scanning and Snyk Container to find affected copies. The Klue/Salesforce investigation closing notice and documentation-on-request text were removed.
Thursday, October 22
1 page change
Content changed
Page change
Trust pagechangedthis change
Snyk added a PHP zero-day notice covering CVE-2026-109618 / CVE-2026-109619: critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution, with PHP security updates released October 21. This is relevant to customers running PHP installations serving web requests. The page also removed the Klue incident summary preview, without indicating resolution.