Security update: PHP vulnerabilities patched (CVE-2026-109618, CVE-2026-109619)
October 22, 2026
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), sometimes called "PHP2Shell". We patched our systems the same day. All Prezly services have run PHP 8.4.27, which contains the fixes, since shortly after it became available.
We have several other protections in place on top of the update:
- Web application firewall (WAF): firewall rules block requests that match the published attack methods.
- Not exposed to the highest-risk setup: these vulnerabilities are most dangerous when PHP runs as a module inside Apache (mod_php). Prezly doesn't run PHP that way.
- Attack path disabled: we turned off the PHP feature used in the published attack.
You don't need to do anything. Your newsrooms and the Prezly app stayed online throughout the update, and we have no indication that Prezly systems or customer data were affected. If you need this confirmed for your security or compliance records, contact our support team.