Security Updates

This list includes some of the more high-profile security releases, and is not the exhaustive list of updates that we provide to our support clients. 

🟢 PHP Zero-Day Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Status: Resolved
Date: October 21, 2026
Two zero-day PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed last week. Both have been fully addressed across our environments. No action is required from clients.

For more information please review the update from our partner services: Pantheon (Status update), Upsun (Rollout details), WPCloud.ca (Announcement), WPEngine (Security update), Cloudflare (Blog post)

🟢 Drupal core critical security update (CVE-2026-108097)

Status: Resolved
Date: October 15, 2026

All Drupal 10 and Drupal 11 customer sites have been patched.

Ready to launch your new project?

Book a call with our team today!