Security update around PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Hack The Box confirms that every customer-facing service that uses PHP runs a fixed PHP release, and that we verified the running version on each service. We hardened our PHP configuration and applied interim mitigation to all customer-facing services as part of the response.

We reviewed our logs and systems for signs of exploitation and found no evidence that either vulnerability was used against our services or that customer data was accessed.

No customer action is required. Integrations, LTI configuration, keys and settings do not need to change.

We are also tracking separate researcher claims about other issues in the fixed releases and continue to review our applications for exposure.

HTB Team