Veracode is aware of the recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and has conducted an assessment of potential impact to our customer-facing platform.

Veracode has determined that the Veracode Platform, including Analysis Center, is not impacted by these vulnerabilities.

As a precaution, we are also reviewing third-party products and services used within our broader environment and working with applicable providers to validate their exposure and patch status. Any affected services will be addressed in accordance with our vulnerability management processes.

We will continue to monitor developments related to these vulnerabilities and take appropriate action as necessary.