News & Updates
PHP security release (October 2026): Qase is patched
On October 21, the PHP project released fixes for critical vulnerabilities in the PHP engine. All Qase cloud environments are now running the fixed version, and there's nothing you need to do.
Erik Berdonces
Updated: October 21, 2026, 19:00 UTC
Summary: On October 21, the PHP project released fixes for critical vulnerabilities in the PHP engine. Qase's application runs on PHP, so we patched it. All Qase cloud environments, including our US and EU regions and every dedicated cluster, are now running the fixed version. We have no evidence either vulnerability was used against Qase, and there's nothing you need to do.
What happened
On October 20, the PHP Foundation announced that a critical security release was coming the next day. The release (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) fixes two critical vulnerabilities in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Both could allow an unauthenticated attacker to run code on an affected server.
PHP powers a large share of the web, so this release affects a lot of software at once, and it's getting wide attention. You can read the official announcement on php.net.
What we did
We treated this as a priority from the moment the advance notice went out. Here's the sequence (times in UTC):
October 20: Our engineering team reviewed the advance notice and mapped every environment that would need the update.
October 21, morning: Before the fix was available, we applied the mitigation recommended by the PHP community, which turns off the PHP feature the known attack relies on. We first confirmed Qase doesn't use that feature, so the change had no effect on how the product works.
~12:00: The PHP project released the patched version. We verified the source and signature of the build before using it.
By ~15:50: Our US and EU cloud environments were running the patched version (PHP 8.4.27).
By ~16:21: Every dedicated cluster was running the patched version (PHP 8.4.27).
What we checked
After the update, we reviewed our monitoring across both regions. We saw normal behavior: no unusual errors, and no traffic patterns consistent with an attack or data being taken.
We also reviewed what else could be affected:
The Qase application in all cloud environments: patched.
Qase reporters and SDKs: not affected. They run in your own environment and talk to Qase through our public API.
The qase.io website: not affected. It doesn't run on PHP.
What you need to do
If you use Qase cloud, in any region or on a dedicated cluster, you don't need to do anything with respect to Qase.
If your own systems run PHP, we recommend updating to the patched release as soon as you can.
How we handle security releases
When a critical vulnerability is announced in software we depend on, we follow the same steps: watch for advisories early, reduce exposure before a fix exists, apply the fix everywhere as soon as it's released, verify it, and monitor afterward. That's what happened here.
You can find more about how we protect your data on our security page.
Questions
If you have questions, or need this information for a security review, contact our support team or your customer success manager. We'll update this post if anything changes.
