rewindex

CompaniesAstronomerIncidents

Astronomer: PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images

No impact listedStatus: monitoringStarted Not resolved1 updatestatus.astronomer.io (opens in new tab)

CVEs mentioned

Only CVEs the vendor’s text names by id, or that its notice says it is not affected by. A mention is not a statement that the vulnerability caused this incident.

Timeline of updates

  1. monitoring

    PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
    Astronomer has conducted a thorough internal review of its code and container images and confirmed that Astro and Astro Private Cloud do not include PHP and are therefore not affected by the recently disclosed PHP vulnerabilities.

    Customer action: Customers should review their own code and any modifications they have made to Astronomer-provided runtime images (for example, custom-installed packages or system dependencies) to determine whether PHP is present and whether they may be impacted. Please follow the guidance in the NCSC advisory: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php (opens in new tab) and the PHP project’s security update to remediate any affected components.

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on status.astronomer.io (opens in new tab).

Astronomer profileRecent Astronomer incidentsMarkdownJSON