We have seen no evidence that any of Castor's systems were impacted by the disclosed PHP vulnerabilities.

As no new official advisories have been published and no credible or confirmed reports have been made of any remaining vulnerabilities of this class, we feel confident in marking this as resolved now.

All of our services have been updated and are now running versions that have received today's PHP security releases.

There have been no further security advisories or other announcements from the PHP organization since these releases were made available, but we do see a lot of continued interest in the original vulnerabilities, with a lot of security research in this area currently still ongoing.

As such we will continue to monitor the situation closely for at least the next 24 to 48 hours, and will keep this incident open to share information should any new developments come to light.

The majority of our services that were affected by the PHP vulnerabilities have been updated. Meanwhile we are continuing to monitor the situation as more information is still being published by vendors and security researchers.

We have deployed updated PHP versions for some of our main applications, including CDMS, but work continues to complete the deployment of updates across our entire suite of services. Next update expected within the hour.

The PHP project has released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Our team is rolling out the patched PHP versions across our infrastructure, following our prepared patch procedure.

The mitigations we applied earlier remain in place during the rollout, and we continue to monitor all traffic for signs of exploitation attempts.

We still have no indication that our systems or customer data have been affected. All services are operating normally, and no action is required from customers.

We will post another update once the rollout is complete. Next update by 17:00 UTC or sooner if anything changes.