On October 21, 2026 the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PulseAI does not use PHP anywhere in its platform, website, or status page, so neither vulnerability affects PulseAI or your data. No action is needed on your side.
On October 21, 2026 the PHP project released fixes for two critical vulnerabilities in the PHP interpreter:
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP Foundation’s security release notice has the details.
Both vulnerabilities are in the PHP interpreter itself, so they can only be exploited on a system that runs PHP. PulseAI does not. No part of the PulseAI application, its API, AI assistant access, the pulseai.now website, or status.pulseai.now is written in PHP or runs the PHP interpreter.
We confirmed this on October 22, 2026 by reviewing the source code of every PulseAI service and the server runtimes our production platform runs on. None of them include PHP.
Nothing. There is no PulseAI update to apply and no setting to change. If your vendor-risk or security team is collecting statements from suppliers about these vulnerabilities, you can point them to this page.
If you believe you have found a security issue in PulseAI, our security and responsible disclosure page explains how to report it.
At a glance
partnerships@pulseai.now