Aptible: Critical PHP vulnerabilities - customer action may be required
Affected components: Aptible Deploy
Timeline of updates
- monitoring
Aptible is aware of the vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP applications that can allow for remote code execution under certain conditions.
Aptible Platform Impact
Aptible has reviewed all infrastructure components that we manage and has confirmed that all are unaffected by this vulnerability.
Customer Application Impact:
Any customer using PHP in their applications is highly encouraged to take action and patch their applications as soon as possible. If you are unable to patch in a timely manner, consider taking your application offline in the interim. Note for the safety of the Aptible platform, we may disable endpoints for applications that show evidence of being exploited by RCE.
Aptible provides the platform your application runs on. The PHP runtime version your app uses is controlled by your app's configuration. We cannot patch this for you automatically. Update your PHP version and redeploy as soon as the fixed release is available for your branch.
If you need help with these upgrades, reach out to Aptible support.
Additional Resources:
- Official PHP advisory: https://www.php.net/index.php#2026-10-20-1 (opens in new tab)
- Proof of concept exploit: https://jackalsyn.com/posts/php-up-2026.html (opens in new tab)
- CVE-2026-109618, CVE-2026-109619
We will update this notice as the situation develops.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
Rewindex captured this after the last checkpoint; the next run () commits it.
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).