Assessment of recently reported PHP vulnerabilities

What to do

• Check whether your product depends on Zapier. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 44m it lasted.

  Anything that failed between 2026-10-22 14:02 UTC and 2026-10-22 14:46 UTC may need a replay.

• Subscribe to Zapier's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=zapier works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Zapier 2

1. investigatingOct 22, 2026, 2:02 PM UTC

   We have not identified customer impact related to the PHP vulnerabilities reported on October 21, 2026. Our security and engineering teams are reviewing potential exposure **in** NodeJS services and across Zapier. The assessment is ongoing. We will share further findings here as they are confirmed. Please reach out to our [Support team](https://zapier.com/app/get-help "Support team") if you need any help in the meantime.

   provider

2. resolvedOct 22, 2026, 2:46 PM UTC

   Our investigation into the reported PHP vulnerabilities is complete. We found no impact on Zapier services or customer data. This advisory is now closed. **Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)** > **1. What is this issue?** > Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can lead to remote code execution under certain conditions. They affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. > > **2. Is Zapier affected?** > Our investigation is complete, and we found no impact on Zapier services or customer data. > > **3. Has customer data been affected?** > No. Our investigation found no impact to customer data. > > **4. Does this affect the Zapier WordPress integration for example?** > The Zapier WordPress plugin itself is not vulnerable. WordPress sites run on PHP, though, so site owners should make sure their PHP version is patched (see question 1 for the affected versions). > > **5. Could PHP applications I host be affected?** > Possibly. Applications you run yourself, including on third-party hosting platforms, may be vulnerable if they run an affected PHP version, regardless of Zapier. We recommend updating to a patched PHP version.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.