IIZUKA Case Manager is not affected by the PHP vulnerabilities
Yesterday (21 October 2026), the PHP Foundation disclosed two critical vulnerabilities affecting PHP installations, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (Critical) on CVSS v4.0 and could allow remote code execution through unauthenticated requests. Fixes have been released for supported PHP versions.
Case Manager is not affected, and neither is any other part of IIZUKA’s infrastructure.
IIZUKA does not use PHP in Case Manager or anywhere else in our organisation, so these vulnerabilities do not apply to us. You don’t need to take any action, and there is no risk to your data or service from this issue.
If you use PHP elsewhere
If your organisation runs other websites or applications built on PHP, we recommend checking them promptly. The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive regular updates, but because of the severity of these issues, the PHP Foundation has released minimal source backports for PHP 7.4, 8.0 and 8.1. If you run one of those versions, contact your vendor or hosting provider, or upgrade to a supported version.
Questions
If you have any questions about Case Manager or the security of your data, please get in touch with your IIZUKA account contact or our support team via support@iizuka.co.uk.
