# Astronomer: PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images

> Astronomer status incident “PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images” on 2026-10-22: impact none (vendor’s label), 1 update(s). Archived by Rewindex.

Canonical: https://rewindex.com/company/astronomer/incidents/01M5JDSVJXDAN1PQYRMY5CHP50
Last updated: 2026-10-26T03:39:28Z

- Impact (vendor’s label): none
- Status: monitoring
- Started: 2026-10-22 18:26 UTC · Resolved: not resolved · Duration: ongoing
- Updates: 1
- [Vendor status page: https://status.astronomer.io/incidents/01M5JDSVJXDAN1PQYRMY5CHP50](https://status.astronomer.io/incidents/01M5JDSVJXDAN1PQYRMY5CHP50)
- [Company: Astronomer](https://rewindex.com/company/astronomer.md)

## CVEs mentioned

- [CVE-2026-109618](https://rewindex.com/cve/CVE-2026-109618.md) RCE via OOM corruption (CVSS 9.8 critical): says not affected (“Not Affected”)
- [CVE-2026-109619](https://rewindex.com/cve/CVE-2026-109619.md) RCE via stale global state (CVSS 8.1 high): says not affected (“Not Affected”)

_Only CVEs the incident text names by id, or that the notice says the vendor is not affected by. Not a statement of cause._

## Timeline of updates

- **monitoring** 2026-10-22 18:26 UTC: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Astronomer has conducted a thorough internal review of its code and container images and confirmed that Astro and Astro Private Cloud do not include PHP and are therefore not affected by the recently disclosed PHP vulnerabilities. Customer action: Customers should review their own code and any modifications they have made to Astronomer-provided runtime images (for example, custom-installed packages or system dependencies) to determine whether PHP is present and whether they may be impacted. Please follow the guidance in the NCSC advisory: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php and the PHP project’s security update to remediate any affected components.


---
Canonical: https://rewindex.com/company/astronomer/incidents/01M5JDSVJXDAN1PQYRMY5CHP50 · Markdown: https://rewindex.com/company/astronomer/incidents/01M5JDSVJXDAN1PQYRMY5CHP50.md · JSON: https://rewindex.com/api/v1/companies/astronomer/incidents/01M5JDSVJXDAN1PQYRMY5CHP50 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:39:28.666Z