Industry-wide PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

We have patched our core services to the fixed versions released by the PHP project to address CVE-2026-109618 and CVE-2026-109619 as well as applied mitigating controls. We are continuing to monitor the situation and validating that remediation is complete.

We found no evidence that customer data was accessed or that the Qualtrics platform was affected.

Status: Mitigation in place, remediation in progress

Mitigations in place
Qualtrics is actively applying updates across all potentially affected infrastructure and has deployed mitigation controls. Our security operations team continues to monitor our environment for any suspicious activity. We will share further updates as additional information becomes available.

The PHP project has announced critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP. A security release addressing these issues was published today, October 21, 2026. Proof-of-concept exploits have been published, and security researchers have reported exploitation in the wild.

What we're doing
Our security and engineering teams are treating this as a top priority. We are rolling out the patched PHP version across the affected services in our environment, and we are monitoring for suspicious activity while updates are in progress.

Customer impact
At this time, we have no evidence that customer data has been accessed or that the Qualtrics platform has been affected.

What you need to do
No action is required from customers at this time.