Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

What to do

• Check whether you use Akamai Akamai Customer Community in us. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 2d 5h it lasted.

  Anything that failed between 2026-10-21 15:03 UTC and 2026-10-23 20:18 UTC may need a replay.

• Subscribe to Akamai's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=akamai works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Akamai 5

1. investigatingOct 21, 2026, 3:03 PM UTC

   Akamai is aware of the recently published remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-10961). Our subject matter experts are actively investigating and taking the appropriate measures. We have released security updates to address these CVEs and monitor for exploitation attempts. We are actively monitoring our platform while we perform the mitigation actions. If you have questions or are experiencing an impact due to this issue, please use the Support Center on Akamai Community (https://community.akamai.com/customers/s/support), or Akamai Control Center, to contact Akamai Technical Support. Contact information is available at https://www.akamai.com/us/en/support/.

   provider

2. investigatingOct 22, 2026, 1:44 AM UTC

   We are continuing to assess the reported vulnerabilities (CVE-2026-109618 and CVE-2026-10961) across our systems and applications. Our initial assessment has identified systems and applications that may be affected, and remediation efforts, including patching, are actively underway.At this time, we have found no evidence indicating that these vulnerabilities have impacted our products, API calls, or Control Center. We will continue to review our systems and applications to assess potential exposure and identify any additional remediation requirements.Mitigation efforts are being prioritized based on the assessment of potential risk and impact. We remain focused on addressing identified vulnerabilities and will provide further updates as additional information becomes available. We will provide further updates as we make progress.

   provider

3. identifiedOct 22, 2026, 6:15 PM UTC

   Update - We are continuing to assess the reported vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our systems and applications. Our initial assessment has identified systems and applications that may be affected, and remediation efforts, including patching, are actively underway.At this time, we have found no evidence indicating that these vulnerabilities have impacted our products, API calls, or Control Center. We will continue to review our systems and applications to assess potential exposure and identify any additional remediation requirements. Mitigation efforts are being prioritized based on the assessment of potential risk and impact. We remain focused on addressing identified vulnerabilities and will provide further updates as additional information becomes available. We will provide further updates as we make progress.

   provider

4. resolvedOct 23, 2026, 8:18 PM UTC

   We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these vulnerabilities impacted Akamai products, API calls, or Control Center. Customers and partners can view additional details by logging in to Control Center or contacting Akamai Support.We apologize for any concern this advisory may have caused and thank you for your patience and continued support. We remain committed to improving our systems and reducing the risk of similar issues in the future.

   provider

5. postmortemOct 29, 2026, 1:52 AM UTC

   Customers and partners can find an incident summary report, here: https://community.akamai.com/customers/s/feed/0D5a700001aNd78CAC

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.