🛡️ Security update: PHP patched, no customer action needed

Published: October 23, 2026

On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws could allow an attacker to run code on an unpatched server. They affect the PHP software that hosts a site, not customer accounts, API keys, or VAT records.

VAT API applied Ubuntu's security update the same day and restarted the web service so the patched PHP is what is running. The API stayed online. We have no evidence that this server was compromised.

Security firms have since reported scanning and failed exploit attempts against unpatched PHP servers. They have not confirmed a successful attack on systems that already have these patches.

A follow-up advisory on 23 October, CVE-2026-115560, describes a related issue that only applies to an unusual session configuration. VAT API does not use that configuration, so no further change is required.

You do not need to reset your API key, change how you call the API, or update your integration.