HackerOne Advisory: Response to CVE-2026-109618 and CVE-2026-109619

Security Advisory

Closed

Last Updated

October 22, 2026

Incident ID

PHP-2026-10

We have completed our response to the two critical PHP runtime vulnerabilities disclosed by the PHP project on October 21 (CVE-2026-109618 and CVE-2026-109619, both CVSS v4 9.2). This update summarizes where we stand so that customers responding to supply chain security questionnaires have a direct reference point.

Our core platform does not run on PHP.

Properties we operate that run PHP:
- HackerOne Code (app.pullrequest.com, reviewer.pullrequest.com): running PHP 8.3.36.
- Marketing site (hackerone.com): running PHP 8.3.36.
- Hacker101 CTF (ctf.hacker101.com): offline during remediation and will return once upgraded.

We have no confirmed indicators of exploitation on HackerOne-operated infrastructure.

For researchers: findings against HackerOne-owned assets related to CVE-2026-109618 or CVE-2026-109619 are in scope for our bounty program. Reference the CVE identifier in the report title and body. Review the program scope at hackerone.com/security for the current asset list.