PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Incident Report for Proemion

Resolved

With regard to the two widely advertised PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 we clarify that Proemion does not use the affected technology in any part of its DataPlatform or ancillary systems.

We became aware of the vulnerabilities on Oct 21 13:05 CEST and immediately coordinated internally to assess the risk which was limited to Proemion website. We setup a static copy of the website and then took the services offline until after a patch was provided and installed. Additionally we waited a 12h cooldown time before bringing the website back online. There is no evidence that the vulnerabilities were used successfully against the website.

The Proemion website runs on separate infrastructure without any connection to our other services.

We release this statement to all customers who might need it for their own purposes.

Posted Oct 21, 2026 - 13:15 CEST