rewindex

ChangesZapierAssessment of recently reported PHP vulnerabilities

Zapier: Incident updated: Assessment of recently reported PHP vulnerabilities

Incident updateNormal progress (rule, 100%)Changed status.zapier.com (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Zapier removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: investigating
After: resolved
AddedResolved time#2
Before: not present
After: 2026-10-22 14:46 UTC
AddedUpdateresolved#3
Before: not present
After: Our investigation into the reported PHP vulnerabilities is complete. We found no impact on Zapier services or customer data. This advisory is now closed. Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) "1. What is this issue? Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can lead to remote code execution under certain conditions. They affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. 2. Is Zapier affected? Our investigation is complete, and we found no impact on Zapier services or customer data. 3. Has customer data been affected? No. Our investigation found no impact to customer data. 4. Does this affect the Zapier WordPress integration for example? The Zapier WordPress plugin itself is not vulnerable. WordPress sites run on PHP, though, so site owners should make sure their PHP version is patched (see question 1 for the affected versions). 5. Could PHP applications I host be affected? Possibly. Applications you run yourself, including on third-party hosting platforms, may be vulnerable if they run an affected PHP version, regardless of Zapier. We recommend updating to a patched PHP version. "

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

Thursday, October 22

1 incident change

All Zapier changesZapier profileMarkdownJSON