Security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619)
Last updateresolvedOct 22 · 09:23 UTC
All Deskpro Cloud helpdesks remain online on the patched version. We are now working through some follow-on effects of yesterday's outage.
Email: Email sent to Cloud helpdesks during the outage has been processed. If you think a message is still missing, please contact our support team with the address it was sent to and roughly when.
Self-hosted: Patched releases are available (Deskpro 2026.4.17 and DPC 2.27.13) and we strongly recommend customers update as per guidance from the UKs National Cyber Security Centre, the USAs National Security Agency and the EUs Agency for Cyber Security. A release for ARM servers will follow, and we will email affected customers when it is ready.
If you notice anything else unexpected, please contact us via support.deskpro.com.
References:
- https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
- https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/
- https://www.enisa.europa.eu/news/joint-statement-on-critical-php-vulnerabilities
Reported by Deskpro on their status page.
