Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Minor · Started Oct 21, 2026 · 2:22 PM

Duration

< 1m
Severity

Minor
Detection lead

—
User reports

—

Summary

Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core platform, including its upload, transformation, and delivery APIs and Console, does not use PHP and is not affected by these vulnerabilities. Please note that customers who use the Cloudinary PHP SDK in their own applications should update PHP in their respective environments

Started

Oct 21, 2026 · 2:22 PM
Resolved

Oct 21, 2026 · 2:22 PM
Duration

< 1m
Severity

None

Event timeline

How this incident unfolded

✓

Resolved
Oct 21 · 2:22 PM Cloudinary

Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core platform, including its upload, transformation, and delivery APIs and Console, does not use PHP and is not affected by these vulnerabilities. Please note that customers who use the Cloudinary PHP SDK in their own applications should update PHP in their respective environments