.svg)
On 21st October 2026, IT teams across the globe received notification of a serious security issue in PHP, a server-side scripting language that powers around 70% of the internet.
The bugs, coined CVE-2026-109618 and CVE-2026-109619, could theoretically allow cyber criminals to corrupt process memory and execute code. Because of this, they were given a CVSS (Common Vulnerability Scoring System) score of 9.2 out of 10.
After receiving the alert, the Claromentis team took immediate action, with staff working tireless hours to assess and patch every customer platform.
How we kept our customers secure
We support a mixture of SaaS and on-premises Claromentis deployments, with different customers sitting on different SaaS versions, software versions, and custom systems. This meant there wasn’t a quick, one-size-fits-all solution to the problem.
However, this didn’t deter our teams.
As of October 26th, we had successfully patched 100% of all non-custom SaaS environments (versions 1, 2, and 3) and deployed core updates promptly.
In addition to this, we:
- Offered an early-access Web Application Firewall (WAF) rule, free of charge, to all of our SaaS v3 customers before patch application took place.
- Supported customers on v1 and custom PHP 7 systems with tailored upgrade routes, such as upgrading core systems immediately while temporarily disabling conflicting custom modules for 24-48 hours.
- Coordinated security patches and weekend go-live upgrades for clients with specialist deployments.
- Suggested immediate mitigation actions for our self-hosted and on-premises customers, including restricting network access to their internal VPNs and executing direct patch deployments.
Beyond ironing out the technical logistics, the Claromentis technical and customer support teams executed a rapid communication strategy.
Rather than drafting news announcements, they sent individual support tickets to every client, which served as the primary notification and communication method. This ensured all follow-up actions and pending system changes were logged, assigned, and tracked.
Claromentis: A software vendor you can trust
After the PHP vulnerabilities were exposed, industry experts recorded an unprecedented surge in exploitation attempts across the world. Fortunately, most (if not all) of these attempts were unsuccessful.
Though this is in itself a relief, many believe the PHP crisis is a sign of things to come. As threats evolve and hackers embed intelligent AI tools into their practices, organizations of all sizes and industries must carefully consider the cybersecurity maturity of their internal teams and their vendors.
At Claromentis, security is paramount to our operations and is a core part of our culture. We’re an ISO 27001:2022 certified and HIPAA compliant vendor, and continually improve our products and services to reflect the latest cybersecurity best practices.
We’re immensely proud of our team members for acting quickly and diligently, especially in such a high pressure situation. Within just a few days, they were able to secure most of our customer environments, and develop tailored plans for those with more complex systems.
Well done, team!
Explore Claromentis' secure software solutions
Improve operational efficiency, enhance employee engagement, and bolster your compliance efforts, all with one centralized solution.
