October 2026 PHP Security Response

On October 21, 2026, ARUP Laboratories evaluated and responded to newly disclosed PHP web application vulnerabilities, including CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560. ARUP performed a comprehensive review of all public-facing systems, implemented protective security controls, and applied remediation patching to potentially affected systems without incident. 

No evidence of successful exploitation, unauthorized access, or compromise has been identified. 

ARUP Connect, ARUP Gateway, and HL7 interfaces were not impacted by the referenced PHP vulnerabilities, and ARUP continues to monitor and protect its environment against emerging threats.

 For questions, please contact ARUP Client Services using keyword: October 2026 PHP