Assessment Findings
Our security teams have completed their assessments and confirmed that no vulnerable components were identified in our customer-facing applications or applications holding personally identifiable information (PII).
A small number of internal-only systems were identified as requiring remediation. These systems have been patched or are currently being patched.
No evidence of exploitation has been detected through our investigations to date.
Customer Impact
Based on our assessment, no impact to customer-facing applications or customer data has been identified in connection with these vulnerabilities.
No action is currently required from customers.
Ongoing Security Measures
We continue to monitor our environments and complete the remaining internal remediation activities as part of our ongoing security management processes.
We will update this advisory if any material new information becomes available.
References
CVE-2026-109618
CVE-2026-109619
Official PHP Security Advisory
For additional context: What is PHP and why did it spark a global cyber-security scramble?
