# Assessment of recently reported PHP vulnerabilities

- Provider: [Zapier](https://down.guide/zapier)
- Level: confirmed
- Impact: Degraded
- lasted 44m
- started 2026-10-22 14:02 UTC
- id: DWN-40eca83718
- Official page: https://status.zapier.com/incidents/01M5HYPNNVAQQPNWSF691PS7XK

## Updates from Zapier
### 2026-10-22 14:02 UTC: investigating
We have not identified customer impact related to the PHP vulnerabilities reported on October 21, 2026. Our security and engineering teams are reviewing potential exposure \*\*in\*\* NodeJS services and across Zapier.
The assessment is ongoing. We will share further findings here as they are confirmed.
Please reach out to our \[Support team\](https://zapier.com/app/get-help "Support team") if you need any help in the meantime.

### 2026-10-22 14:46 UTC: resolved
Our investigation into the reported PHP vulnerabilities is complete. We found no impact on Zapier services or customer data. This advisory is now closed.
\*\*Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)\*\*
\> \*\*1. What is this issue?\*\*
\> Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can lead to remote code execution under certain conditions. They affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12.
\> 
\> \*\*2. Is Zapier affected?\*\*
\> Our investigation is complete, and we found no impact on Zapier services or customer data.
\> 
\> \*\*3. Has customer data been affected?\*\*
\> No. Our investigation found no impact to customer data.
\> 
\> \*\*4. Does this affect the Zapier WordPress integration for example?\*\*
\> The Zapier WordPress plugin itself is not vulnerable. WordPress sites run on PHP, though, so site owners should make sure their PHP version is patched (see question 1 for the affected versions).
\> 
\> \*\*5. Could PHP applications I host be affected?\*\*
\> Possibly. Applications you run yourself, including on third-party hosting platforms, may be vulnerable if they run an affected PHP version, regardless of Zapier. We recommend updating to a patched PHP version.

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by Sazabi (https://sazabi.com/?utm_source=down-guide&utm_medium=markdown).