Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

Summary

Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these vulnerabilities impacted Akamai products, API calls, or Control Center. Customers and partners can view additional details by logging in to Control Center or contacting Akamai Support.We apologize for any concern this advisory may have caused and thank you for your patience and continued support. We remain committed to improving our systems and reducing the risk of similar issues in the future.

• Started

  Oct 21, 2026 · 3:03 PM

• Resolved

  Oct 23, 2026 · 8:18 PM

• Duration

  2d 5h 15m

• Severity

  None

• ◐

  Investigating

  Oct 21 · 3:03 PM Akamai

  Akamai is aware of the recently published remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-10961). Our subject matter experts are actively investigating and taking the appropriate measures. We have released security updates to address these CVEs and monitor for exploitation attempts. We are actively monitoring our platform while we perform the mitigation actions. If you have questions or are experiencing an impact due to this issue, please use the Support Center on Akamai Community (https://community.akamai.com/customers/s/support), or Akamai Control Center, to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.

• ◐

  Investigating

  Oct 22 · 1:44 AM Akamai

  We are continuing to assess the reported vulnerabilities (CVE-2026-109618 and CVE-2026-10961) across our systems and applications. Our initial assessment has identified systems and applications that may be affected, and remediation efforts, including patching, are actively underway.At this time, we have found no evidence indicating that these vulnerabilities have impacted our products, API calls, or Control Center. We will continue to review our systems and applications to assess potential exposure and identify any additional remediation requirements.Mitigation efforts are being prioritized based on the assessment of potential risk and impact. We remain focused on addressing identified vulnerabilities and will provide further updates as additional information becomes available. We will provide further updates as we make progress.

• ◆

  Identified

  Oct 22 · 6:15 PM Akamai

  Update - We are continuing to assess the reported vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our systems and applications. Our initial assessment has identified systems and applications that may be affected, and remediation efforts, including patching, are actively underway.At this time, we have found no evidence indicating that these vulnerabilities have impacted our products, API calls, or Control Center. We will continue to review our systems and applications to assess potential exposure and identify any additional remediation requirements. Mitigation efforts are being prioritized based on the assessment of potential risk and impact. We remain focused on addressing identified vulnerabilities and will provide further updates as additional information becomes available. We will provide further updates as we make progress.

• ✓

  Resolved

  Oct 23 · 8:18 PM Akamai

  We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these vulnerabilities impacted Akamai products, API calls, or Control Center. Customers and partners can view additional details by logging in to Control Center or contacting Akamai Support.We apologize for any concern this advisory may have caused and thank you for your patience and continued support. We remain committed to improving our systems and reducing the risk of similar issues in the future.