# Zapier: Assessment of recently reported PHP vulnerabilities

- Provider: [Zapier](https://outages.cc/zapier.md)
- Type: Incident
- State: Resolved
- Worst impact: Operational
- Started: 2026-10-22 14:02 UTC
- Resolved: 2026-10-22 14:46 UTC (lasted 44 min)
- Official update: https://status.zapier.com

## Updates from Zapier

### resolved, 2026-10-22 14:46 UTC

Our investigation into the reported PHP vulnerabilities is complete. We found no impact on Zapier services or customer data. This advisory is now closed. **Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)** > **1. What is this issue?** > Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can lead to remote code execution under certain conditions. They affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. > > **2. Is Zapier affected?** > Our investigation is complete, and we found no impact on Zapier services or customer data. > > **3. Has customer data been affected?** > No. Our investigation found no impact to customer data. > > **4. Does this affect the Zapier WordPress integration for example?** > The Zapier WordPress plugin itself is not vulnerable. WordPress sites run on PHP, though, so site owners should make sure their PHP version is patched (see question 1 for the affected versions). >

### investigating, 2026-10-22 14:02 UTC

We have not identified customer impact related to the PHP vulnerabilities reported on October 21, 2026. Our security and engineering teams are reviewing potential exposure **in** NodeJS services and across Zapier. The assessment is ongoing. We will share further findings here as they are confirmed. Please reach out to our [Support team](https://zapier.com/app/get-help "Support team") if you need any help in the meantime.