NINJIO PHP Vulnerability Statement
To whom it may concern:
On October 20, 2026, the PHP security team announced two critical vulnerabilities, CVE-2026-
109618 and CVE-2026-109619, followed by detailed advisories and security updates on October 21.
PHP is a widely used technology supporting websites and web applications. These vulnerabilities
involve errors in how PHP handles memory during web requests and could allow an attacker to
execute unauthorized code on an affected server without logging in. Additional background is
available in the official PHP security advisory.
NINJIO assessed its exposure and confirmed that our public website, ninjio.com, was affected.
Remediation was completed on October 21, 2026, at approximately 9:00 p.m. Pacific Time. This site was vulnerable to the issue but had not been exploited. This system is isolated from all other NINJIO systems and is not judged as a risk to the NINJIO platform or its customers.
NINJIO’s commercial platforms and other services, including those supporting security awareness solutions, were not impacted. Based on our assessment and completed remediation, we have confirmed that our environment is not currently exposed to these vulnerabilities.
Sincerely,
NINJIO Cybersecurity Team
[email protected]
805-864-199
