Security Advisory: PHP Remote Code Execution Vulnerabilities – Update October 22, 2026

  • Updated

Executive Summary
Optimizely has mitigation in place, and our systems are protected against two critical Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) recently disclosed by the PHP Group. Our Web Application Firewall (WAF) provides existing protection against these attack vectors. PHP usage across the Optimizely product ecosystem is minimal; we have confirmed that most of our products are not affected, and for the one component identified as affected, our engineering team is actively applying the official patches.

What Happened

On October 20, 2026, the PHP Group disclosed two critical Remote Code Execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP environments. Official patches to address these vulnerabilities were released on October 21, 2026, at approximately 14:00 UTC.

What We Are Doing

Optimizely Engineering initiated a comprehensive review across our application environment as soon as the vulnerability was released:

  • Mitigation in Place – Our Systems Are Protected: Our Web Application Firewall (WAF) already protects against the attack vectors for CVE-2026-109618 and CVE-2026-109619, so our systems are protected while we complete our review and apply the official patches.
  • Identification & Remediation: Although the footprint of PHP within Optimizely’s environment is very small, our teams quickly reviewed our product suite to determine impact and initiate remediation:
    • Confirmed NOT Affected: We have confirmed that the following products and services are not affected:
      • Analytics
      • CMS
      • Commerce Connect
      • Configured Commerce
      • Content Marketing Platform (CMP)
      • Experimentation
      • Mark
      • Mission Control
      • Optimizely Connect Platform (OCP)
      • Optimizely Data Platform (ODP)
      • Optimizely Graph
      • PaaS Portal
      • Product Information Management (PIM)
      • Product Recommendations
      • Search & Navigation
      • OptiID
      • Turnstile
    • Affected – Active Remediation: Content Recommendations is affected by this disclosure but protected by mitigations. Our engineering team is actively engaged and currently working through applying the required updates and patches.

How to Contact Us

Your security and trust are our top priorities. If you have any questions or require additional information regarding this advisory, please reach out to your Customer Success Manager (CSM) or contact Optimizely Support at support@optimizely.com.