Security Advisory: PHP Remote Code Execution Vulnerabilities – Update October 22, 2026

Executive Summary Optimizely has mitigation in place, and our systems are protected against two critical Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) recently disclosed by the PHP Group. Our Web Application Firewall (WAF) provides existing protection against these attack vectors. PHP usage across the Optimizely product ecosystem is minimal; we have confirmed that most of our products are not affected, and for the one component identified as affected, our engineering team is actively applying the official patches.

On October 20, 2026, the PHP Group disclosed two critical Remote Code Execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP environments. Official patches to address these vulnerabilities were released on October 21, 2026, at approximately 14:00 UTC.

Optimizely Engineering initiated a comprehensive review across our application environment as soon as the vulnerability was released:

Mitigation in Place – Our Systems Are Protected: Our Web Application Firewall (WAF) already protects against the attack vectors for CVE-2026-109618 and CVE-2026-109619, so our systems are protected while we complete our review and apply the official patches.

Identification & Remediation: Although the footprint of PHP within Optimizely’s environment is very small, our teams quickly reviewed our product suite to determine impact and initiate remediation: Confirmed NOT Affected: We have confirmed that the following products and services are not affected : Analytics CMS Commerce Connect Configured Commerce Content Marketing Platform (CMP) Experimentation Mark Mission Control Optimizely Connect Platform (OCP) Optimizely Data Platform (ODP) Optimizely Graph PaaS Portal Product Information Management (PIM) Product Recommendations & OptiID Turnstile Affected – Active Remediation: Content Recommendations is affected by this disclosure but protected by mitigations. Our engineering team is actively engaged and currently working through applying the required updates and patches.

Confirmed NOT Affected: We have confirmed that the following products and services are not affected : Analytics CMS Commerce Connect Configured Commerce Content Marketing Platform (CMP) Experimentation Mark Mission Control Optimizely Connect Platform (OCP) Optimizely Data Platform (ODP) Optimizely Graph PaaS Portal Product Information Management (PIM) Product Recommendations & OptiID Turnstile

Content Marketing Platform (CMP)

Optimizely Connect Platform (OCP)

Optimizely Data Platform (ODP)

Product Information Management (PIM)

Product Recommendations

Affected – Active Remediation: Content Recommendations is affected by this disclosure but protected by mitigations. Our engineering team is actively engaged and currently working through applying the required updates and patches.

Your security and trust are our top priorities. If you have any questions or require additional information regarding this advisory, please reach out to your Customer Success Manager (CSM) or Optimizely Support at [email protected] .