Controls
Published:
Last updated:
Status: Not affected / Remediated
Summary
On 21 October 2026, the PHP project disclosed two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Syncfish has assessed its product and services.
CI Sync is not affected, and the PHP component behind our website has been updated to a patched version.
No action is required by our customers.
Assessment
|
Area |
Status |
Details |
|---|---|---|
|
CI Synchronizer
|
Not affected |
CI Sync does not use PHP or any PHP components. |
|
Syncfish website |
Remediated |
The website runs on a Microsoft-hosted platform that includes a PHP library. Microsoft’s managed update process updated the library to a patched version, and we have independently verified that the patched version is in place. |
Our website is separate from CI Sync and does not store or process customer data.
Customer action required
None. You don’t need to change or update anything in your use of CI Sync.
Ongoing monitoring
We will continue to monitor these vulnerabilities, including any related disclosures or updated guidance from the PHP project and Microsoft. If our assessment changes, we will update this page and contact affected customers directly.
References
-
PHP project announcement: https://www.php.net/archive/2026.php#2026-10-21-5
-
CVE-2026-109618: https://nvd.nist.gov/vuln/detail/CVE-2026-109618
-
CVE-2026-109619: https://nvd.nist.gov/vuln/detail/CVE-2026-109619
Contact
If you have questions about this advisory, please contact security@syncfish.com.au.
Revision history
|
Date |
Change |
|---|---|
|
Initial publication |