ACF Security Update on Recent PHP Vulnerabilities
October 26, 2026
Dear Valued Customers,
ACF Technologies is aware of the critical PHP vulnerabilities CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560, described in CERT-EU Security Advisory 2026-018 (v1.2, October 23, 2026). This notice summarizes our assessment and its results.
Assessment
On October 22, 2026, ACF performed vulnerability scans and configuration reviews of our products, ACF-hosted servers, third-party tools, and corporate website. This included a review of third-party components against the published list of software known to embed PHP. On October 23, 2026, following CERT-EU's disclosure of CVE-2026-115560, ACF reconfirmed these results. No PHP components or dependencies were identified. Based on this assessment, ACF products and ACF-hosted services are not affected by any of these three vulnerabilities.
01 Additional Safeguards
As an added layer of defense, we have deployed Web Application Firewall (WAF) protections against known exploitation attempts related to these vulnerabilities.
02 Customer Action
No action is required for ACF products or ACF-hosted services. For on-premises deployments, ACF software does not use PHP. Because other products may include PHP, we recommend that you assess the other software in your environment against CERT-EU's guidance and your own security policies.
03 Ongoing Monitoring
These advisories are still being updated, and we will continue to monitor them. We will notify you promptly if our assessment changes.
For security or compliance questions, please contact compliance@acftechnologies.com. For technical support, please contact support@acftechnologies.com.
Sincerely,
ACF Technologies Compliance
The future is now, and it begins with smarter decisions.
