Post-incident review: PHP remote code execution vulnerability (CVE-2026-109618)

Summary
On 21 October 2026, a critical vulnerability in PHP (CVE-2026-109618) was publicly disclosed. It affected every maintained PHP version and could allow remote code execution through specially crafted HTTP requests. Pugpig Express, Pugpig Distribution and Pugpig Bondi use PHP, so we treated this as a security incident and patched all production infrastructure as soon as possible on 21 Oct.

Investigation
The vulnerability was reported to have been exploited before it was disclosed. We therefore reviewed production logs from 14 October 2026 to well after patching completed, looking for the indicators of compromise published by the security community. These included memory-exhaustion and segmentation-fault errors raised while PHP parses a request, malformed or oversized request bodies, abuse of PHP’s upload-progress feature, and command execution from the web server.

Findings
We found no evidence that the vulnerability was successfully exploited against Pugpig production systems before patching finished. On one service we saw automated probing consistent with attempts to trigger the vulnerability. Every one of those requests was rejected and failed without the error signatures associated with a successful exploit.

Customer impact
We have no evidence that customer data or systems were accessed through this vulnerability, and there was no service disruption.