Security update: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Last updated: 12:30 PM PST, 10/21/2026

Two critical vulnerabilities in PHP, an open-source programming language many websites and web applications run on, were disclosed October 21, 2026. Some 8x8 interfaces use PHP, and we are applying a protective configuration change to them now.

What happenedlink to this section

• The PHP project released fixes for two critical vulnerabilities in PHP itself.
• They could allow an attacker to run unauthorized code on a server running an affected version.
• Because the flaws are in PHP, they affect any organization that uses it.

What we are doinglink to this section

• We started to identify where 8x8 uses PHP as soon as we learned of the advisory.
• We have also begun deploying recommended mitigation measures and will be applying appropriate fixes to those systems as they become available. These are underway and designed to avoid service impact.

What you need to dolink to this section

• You do not need to take any action for your 8x8 services. We don’t expect any visible change for your agents, supervisors or administrators.
• If your organization runs PHP on its own servers or websites, here is the alert from CISA so you can evaluate and take appropriate action.
• If you get PHP from a Linux distribution or support vendor, you may also wish to check with them. A fixed package may keep an older version number.

Frequently asked questionslink to this section

Is 8x8 affected? Yes. Some 8x8 interfaces use PHP, and we have begun deploying recommended mitigation measures.

Do I need to take action for my 8x8 services? No.

Will I see any change or service impact? We don’t expect any visible change for your users. The rollout is designed to avoid service impact.

What should I do about my own PHP servers? You may find this alert from the US Cybersecurity & Infrastructure Security Agency helpful as you evaluate and take appropriate action. This may include updating to a fixed version, then restarting your web servers and PHP processes. You may also wish to check with your Linux or support vendor if you don’t install PHP directly.

Who do I contact? Contact your 8x8 account team or 8x8 Support. If you need more detail, open a support ticket.