# Snyk: Trust page changed

> Snyk added a PHP zero-day notice covering CVE-2026-109618 / CVE-2026-109619: critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution, with PHP security updates released October 21. This is relevant to customers running PHP installations serving web requests. The page

Canonical: https://rewindex.com/change/p5414
Last updated: 2026-10-22T08:57:43Z

**Summary:** Snyk added a PHP zero-day notice covering CVE-2026-109618 / CVE-2026-109619: critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution, with PHP security updates released October 21. This is relevant to customers running PHP installations serving web requests. The page also removed the Klue incident summary preview, without indicating resolution. _(machine-written, sol)_
- Kind: Trust / security · Label: Changed (not classified) (rule)
- Changed: 2026-10-22 08:57 UTC · Detected: 2026-10-22 08:57 UTC
- [Source: https://trust.snyk.io](https://trust.snyk.io)
- [Company: Snyk](https://rewindex.com/company/snyk.md)
- Versions: before page\_version:978 → after page\_version:5414
- Change 1 of 3 for this page

## What changed

**1. Added**

```diff
  …Privacy Policy and DPA? Updates View all General
+ Zero-Day Incident - PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) - Update #1 Published ‹date› Overview On October 21, the PHP project released security updates for two critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution. If you run PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, you should immediately update to one of the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP states that updating is the only safe choice ( PHP security advisory Opens in new tab ). These are vulnerabilities in the PHP runtime itself (the software that runs your applications), not in PHP library dependencies in your application. If you only use Snyk Open Source scanning, you will not see these CVEs in your results. That doesn’t mean you are unaffected. Is Snyk affected? As of this publication, based on the available information, the Snyk environments are not impacted. We are continuing to monitor. What Snyk can show you Snyk Open Source (CLI and SCM integration) analyzes the dependencies your applications declare, so it does not see which PHP runtime is deployed.  …
  General Supply Chain Compromise Incident - Keyv /…
```

**2. Removed**

```diff
  …Update - Third-Party Vendor Security Incident — Klue
- General
  Third-Party Vendor Security Incident — Klue Published ‹date›…
```

**3. Removed**

```diff
  …Third-Party Vendor Security Incident — Klue Published ‹date›
- Summary Snyk is aware of a security incident at Klue, a third-party vendor we use for competitive intelligence. We were notified of a security incident involving Klue, a market intelligence platform used by Snyk and a wide range of companies for competitive intelligence. An unauthorized party accessed data from Snyk's Salesforce environment through Klue's integration. Other security vendors, such as Recorded Future Opens in new tab , Tanium Opens in new tab , Huntress Opens in new tab , and Jamf Opens in new tab have been impacted and have shared updates publicly. Impact on Snyk products and services This incident did not affect Snyk's products, and there was no impact on our ability to serve our customers. The Snyk platform, our scanning engines, and customer-facing services were not involved in any way. Our response After Klue notified us of the incident, we immediately disabled Klue's integration within Salesforce. We have engaged our security team to conduct an independent review, taken steps to protect our environment, and notified law enforcement. We have established the timeline of unauthorized access to our Salesforce environment and are reviewing what data was affected. Wh …
  . Read more Read more about Third-Party Vendor…
```

## History of this page

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-22 08:57 UTC | Trust page changed (this change) | Changed (not classified) |
| 2026-10-29 09:03 UTC | [Trust page changed](https://rewindex.com/change/p10516.md) | Changed (not classified) |
| 2026-10-31 09:00 UTC | [Trust page changed](https://rewindex.com/change/p12090.md) | Changed (not classified) |

Next: [change](https://rewindex.com/change/p10516.md) · All Snyk changes: [timeline](https://rewindex.com/company/snyk/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/p5414 · Markdown: https://rewindex.com/change/p5414.md · JSON: https://rewindex.com/api/v1/changes/p5414 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T13:16:52.525Z