PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) - No Impact to BS&A Cloud

Incident Report for BSA Cloud

Resolved

On October 21, 2026, two critical vulnerabilities affecting PHP were publicly disclosed (CVE-2026-109618 and CVE-2026-109619).Based on our review, BS&A Cloud is not impacted. BS&A Cloud does not run on PHP, which is the component affected by these vulnerabilities. Upon disclosure, our IT & Security team reviewed our hosting environment, network infrastructure and relevant third-party providers for any exposure, and took precautionary steps where warranted. We will continue to monitor and will update this notice if anything changes. No action is required on your part for BS&A Cloud. Questions can be directed to BS&A Support.

Posted Oct 22, 2026 - 09:00 EDT