PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Incident Report for Civitas Learning

Resolved

Civitas Learning has assessed CVE-2026-109618 and CVE-2026-109619, which affect PHP web runtimes. Our services include PHP-based web components that were potentially affected. Civitas Learning applied remediation on October 21, 2026, and the vulnerabilities are no longer present in our environment. We have identified no indicators of exposure, compromise, or abuse related to these vulnerabilities, and no customer action is required. If you have any additional questions please email support@civitaslearning.com.

Posted Oct 21, 2026 - 08:00 CDT