# Zapier: Incident updated: Assessment of recently reported PHP vulnerabilities

> Incident updated: Assessment of recently reported PHP vulnerabilities. Detected 2026-10-22 by Rewindex: what changed on Zapier’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/r1c31c0ca4529b2
Last updated: 2026-10-22T14:53:15Z

**Summary:** _summary pending_
- Kind: Incident update · Label: Normal progress (rule)
- Changed: 2026-10-22 14:53 UTC · Detected: 2026-10-22 14:53 UTC
- [Source: https://status.zapier.com/incidents/01M5HYPNNVAQQPNWSF691PS7XK](https://status.zapier.com/incidents/01M5HYPNNVAQQPNWSF691PS7XK)
- [Company: Zapier](https://rewindex.com/company/zapier.md)
- Versions: before incident\_version:62/01M5HYPNNVAQQPNWSF691PS7XK@2c8f70813fa7 → after incident\_version:62/01M5HYPNNVAQQPNWSF691PS7XK@0ba6e8594878
- Change 1 of 1 for this incident

Incident page (full timeline): [Assessment of recently reported PHP vulnerabilities](https://rewindex.com/company/zapier/incidents/01M5HYPNNVAQQPNWSF691PS7XK.md)
## What changed

**1. Changed: Status**

```diff
- investigating
+ resolved
```

**2. Added: Resolved time**

```diff
+ 2026-10-22 14:46 UTC
```

**3. Added: Update** (resolved) · 2026-10-22 14:46 UTC

```diff
+ Our investigation into the reported PHP vulnerabilities is complete. We found no impact on Zapier services or customer data. This advisory is now closed. Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) "1. What is this issue? Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can lead to remote code execution under certain conditions. They affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. 2. Is Zapier affected? Our investigation is complete, and we found no impact on Zapier services or customer data. 3. Has customer data been affected? No. Our investigation found no impact to customer data. 4. Does this affect the Zapier WordPress integration for example? The Zapier WordPress plugin itself is not vulnerable. WordPress sites run on PHP, though, so site owners should make sure their PHP version is patched (see question 1 for the affected versions). 5.	Could PHP applications I host be affected? Possibly. Applications you run yourself, including on third-party hosting platforms, may be vulnerable if they run an affected PHP version, regardless of Zapier. We recommend updating to a patched PHP version. "
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-22 14:53 UTC | Incident updated: Assessment of recently reported PHP vulnerabilities (this change) | Normal progress |

All Zapier changes: [timeline](https://rewindex.com/company/zapier/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/r1c31c0ca4529b2 · Markdown: https://rewindex.com/change/r1c31c0ca4529b2.md · JSON: https://rewindex.com/api/v1/changes/r1c31c0ca4529b2 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T05:12:08.380Z