Security announcement | 21 October 2026
Rapid4Cloud has completed the application of the latest PHP security updates to affected components across the Rapid4Cloud suite.
The maintenance addresses two recently disclosed critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The PHP project reported that the vulnerabilities could allow unauthenticated remote code execution in affected environments.
The PHP security release of 21 October 2026 provided fixes for supported versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Our team reviewed the affected areas of the Rapid4Cloud suite and applied the relevant current PHP security updates. This work forms part of our ongoing security maintenance programme and supports the secure, reliable operation of the platform.
No customer action is required. The update has been applied to the relevant Rapid4Cloud components, and we will continue to monitor the environment and maintain our regular patching and security review processes.
PHP official security release: php.net
UK National Cyber Security Centre advisory: Critical security issue affecting PHP