The PHP project recently announced two critical security vulnerabilities. You can read more about these on their website:
https://www.php.net/archive/2026.php#2026-10-21-5
Wiz Research has also written about this on a dedicated website for the 2 CVEs:
As IT teams are handling these vulnerabilities, figuring out where they are affected and what systems need to be upgraded, we've gotten customer requests to clarify if our products are affected or not. Thus, to make this information easily available to everyone we've decided to put this clarification here;
Mender
For Mender users, see this blog post:
CFEngine
For CFEngine users, see this blog post:
https://cfengine.com/blog/2026/php-cves-cve-2026-109618-and-cve-2026-109619/
Alvaldi
Alvaldi is not affected - the Alvaldi product, website, and documentation do not use PHP.
Websites
The northern.tech and devicechronicle.com websites are hosted by Hubspot, and do not use PHP, so they are not affected. This is from HubSpot's website / incident status page:
HubSpot is aware of the recently disclosed PHP security vulnerability. PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes.
We wish IT and security teams the best of luck in handling these vulnerabilities.
