PHP Remote Code Execution (CVE-2026-109618 and CVE-2026-109619)

Summary

Two critical PHP Remote Code Execution CVEs (CVE-2026-109618 and CVE-2026-109619) were disclosed prior to the security update. Out of an abundance of caution, we have reviewed and will continue to monitor our products and public facing assets related to this issue.

• Pingdom uses PHP, but we have implemented compensating controls to protect the product.
• We have implemented compensating controls for our external website that utilize PHP.

For additional information on these vulnerabilities, please visit the vendors website Official PHP Security Advisory.

Note: There is no action needed from customers on this issue.

Affected Products

SolarWinds Pingdom and SolarWinds External Websites.