# Zapier: Assessment of recently reported PHP vulnerabilities

> Zapier status incident “Assessment of recently reported PHP vulnerabilities” on 2026-10-22: impact none (vendor’s label), 44 min, 2 update(s). Archived by Rewindex.

Canonical: https://rewindex.com/company/zapier/incidents/01M5HYPNNVAQQPNWSF691PS7XK
Last updated: 2026-10-26T04:06:51Z

- Impact (vendor’s label): none
- Status: resolved · edited after publishing
- Started: 2026-10-22 14:02 UTC · Resolved: 2026-10-22 14:46 UTC · Duration: 44 min
- Updates: 2
- [Vendor status page: https://status.zapier.com/incidents/01M5HYPNNVAQQPNWSF691PS7XK](https://status.zapier.com/incidents/01M5HYPNNVAQQPNWSF691PS7XK)
- [Company: Zapier](https://rewindex.com/company/zapier.md)

## CVEs mentioned

- [CVE-2026-109618](https://rewindex.com/cve/CVE-2026-109618.md) RCE via OOM corruption (CVSS 9.8 critical): says not affected (“no impact on”)
- [CVE-2026-109619](https://rewindex.com/cve/CVE-2026-109619.md) RCE via stale global state (CVSS 8.1 high): says not affected (“no impact on”)

_Only CVEs the incident text names by id, or that the notice says the vendor is not affected by. Not a statement of cause._

## Timeline of updates

- **investigating** 2026-10-22 14:02 UTC: We have not identified customer impact related to the PHP vulnerabilities reported on October 21, 2026. Our security and engineering teams are reviewing potential exposure in NodeJS services and across Zapier. The assessment is ongoing. We will share further findings here as they are confirmed. Please reach out to our Support team "Support team": https://zapier.com/app/get-help if you need any help in the meantime.
- **resolved** 2026-10-22 14:46 UTC: Our investigation into the reported PHP vulnerabilities is complete. We found no impact on Zapier services or customer data. This advisory is now closed. Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) "1. What is this issue? Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can lead to remote code execution under certain conditions. They affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. 2. Is Zapier affected? Our investigation is complete, and we found no impact on Zapier services or customer data. 3. Has customer data been affected? No. Our investigation found no impact to customer data. 4. Does this affect the Zapier WordPress integration for example? The Zapier WordPress plugin itself is not vulnerable. WordPress sites run on PHP, though, so site owners should make sure their PHP version is patched (see question 1 for the affected versions). 5.	Could PHP applications I host be affected? Possibly. Applications you run yourself, including on third-party hosting platforms, may be vulnerable if they run an affected PHP version, regardless of Zapier. We recommend updating to a patched PHP version. "

## Rewindex changes for this incident

- 2026-10-22 14:53 UTC: [Incident updated: Assessment of recently reported PHP vulnerabilities](https://rewindex.com/change/r1c31c0ca4529b2.md)


---
Canonical: https://rewindex.com/company/zapier/incidents/01M5HYPNNVAQQPNWSF691PS7XK · Markdown: https://rewindex.com/company/zapier/incidents/01M5HYPNNVAQQPNWSF691PS7XK.md · JSON: https://rewindex.com/api/v1/companies/zapier/incidents/01M5HYPNNVAQQPNWSF691PS7XK · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:06:51.994Z