On October 21, 2026, the PHP project released security updates for two critical remote code execution (RCE) vulnerabilities in the PHP interpreter (CVSS v4: 9.2). The vulnerabilities affect all PHP installations serving web requests, including PHP-FPM, mod_php and php-cgi. Systems that do not run PHP are not at risk.
For more information please visit following links:
https://access.redhat.com/security/cve/cve-2026-109618
https://access.redhat.com/security/cve/cve-2026-109619
Tegsoft products do not include a PHP interpreter or module and are therefore not affected by these vulnerabilities.
No action is required for your Tegsoft environments.
If your own systems integrated with Tegsoft use PHP, we recommend upgrading them to the latest patched PHP releases.
For questions: support@tegsoft.com