Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-

Dear Customer,
 
Gamma is aware of the recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which have been reported as potentially enabling remote code execution on affected PHP deployments. The vulnerabilities have been assigned a CVSS score of 9.2, and the PHP Foundation has announced that a security update is being released to address the issue. [cert.europa.eu]
Gamma has completed an initial assessment of its environment and is currently awaiting the vendor patch that addresses these vulnerabilities.
 
In the meantime, Gamma's Security Operations and Infrastructure teams are actively monitoring our networks, systems, and security tooling for any indicators of compromise (IoCs) or malicious activity that may be associated with exploitation attempts.
 
Once the vendor patch has been validated and is available for deployment within our environment, Gamma will implement the update as soon as technically possible, following our standard change and release management processes to ensure service stability and security.
 
We will continue to monitor and assess any new information published by the PHP Foundation and relevant cybersecurity authorities and will provide further updates should our risk assessment change. To protect our customers and services, Gamma reserves the right to implement protective measures, including the temporary suspension of affected systems without prior notice, should the threat level increase or an immediate response be required.
 
Should you have any questions regarding Security at Gamma please contact Security@gamma.co.uk