PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: impact on Digital Theatre+ (October 2026)

What are these vulnerabilities?

On 21 October 2026, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow an attacker to run code on a web server without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Is Digital Theatre+ affected?

The Digital Theatre+ platform, including its hosting, APIs, integrations, third-party components and customer-facing components, does not use PHP. Our marketing website and support site are hosted by HubSpot and do not use PHP either.

One internal analytics component in our supporting infrastructure does use PHP, and it was affected by both vulnerabilities. It was running PHP 8.4.26 at the time.

What have we done?

We assessed the vulnerabilities on 21 October 2026 and updated the analytics component to PHP 8.4.27 the same day, completing at 20:11 UTC. The component was already behind a web application firewall. We added no other interim measures, because the fix was applied the day it became available.

The component’s containers were rebuilt and replaced, so nothing from the earlier version is still running. We also turned off a PHP feature, session upload progress, that the PHP advisory recommends disabling even after patching.

We then reviewed the component’s web server, PHP and firewall logs, its audit log and its stored files for the period before the update. We found no evidence of exploitation or unauthorised access, and no customer data, services or environments were affected. Nothing is outstanding.

Do I need to take action?

No. There is nothing to change in your Digital Theatre+ account, single sign-on or network settings.

Where do we publish security updates?

We publish security advisories on this support site.

If you have questions, contact support@digitaltheatreplus.com.