Cloudinary: Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Timeline of updates
- resolved
Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Cloudinary’s core platform, including its upload, transformation, and delivery APIs and Console, does not use PHP and is not affected by these vulnerabilities.
Please note that customers who use the Cloudinary PHP SDK in their own applications should update PHP in their respective environments
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
Rewindex captured this after the last checkpoint; the next run () commits it.
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).