Two critical vulnerabilities on the PHP programming language have been published today October 21, 2026:

CVE-2026-109618 : remote code execution allowed by memory corruption when handling insufficiant memory errors.
CVE-2026-109619 : Remote code execution by reusing an obsolete global flag (« use after free »).

Those two vulnerabilities are part of the PHP parser itself (php-src), a well-used product used in developing web interfaces. The following versions are affected:

PHP 8.2 before 8.2.35;
PHP 8.3 before 8.3.36;
PHP 8.4 before 8.4.27;
PHP 8.5 before 8.5.12.

Windows Octopus Applications (WinUI), our Web portal (WebUI) or Octopus 5 are not affected by those vulnerabilities.  Octopus is developed using the Microsoft .NET platform and does not uses PHP at any level.

As such :

No PHP code exists in our product;
No PHP parser is shipped or required;
No third-party built-in component interfaces with PHP;
No IIS configuration within Octopus uses PHP.

No Octopus updates or action from you are required for those two vulnerabilities.

However, if your organization is in one of the situations mentioned lower, you could have to manage vulnerability within those adjacent systems which are outside the scope of our team’s responsibility:

• Use an authentication page written in PHP to access our Web portal instead of the .aspx version provided by our team;
• Use a PHP wrapper to access the Web portal or KPIs;
• Use automation tool written in PHP to ease the integration of Octopus within your ecosystem.

Thanks for your habitual cooperation