On October 21, 2026, the PHP Project announced updates to address two critical severity vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
These CVEs have generated considerable media attention, leading customers to ask how ArcGIS software may be impacted.
- Esri does not use PHP as part of the ArcGIS Online SaaS offering.
- Esri is continuing to inventory and evaluate ArcGIS products and other systems potentially impacted by the reported PHP vulnerabilities.
- If a product is impacted, additional information will be added here as fixes are made available.
Commenting is not enabled for this article.