UPDATED 10/22/26
On October 21, 2026, the PHP Project announced updates to address two critical severity vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619.
These CVEs have generated considerable media attention, leading customers to ask how ArcGIS software may be impacted.
- Esri does not use PHP as part of the ArcGIS Online SaaS offering and is therefore not affected.
- Foundational products of ArcGIS Enterprise (Server, Portal, Data Store) and ArcGIS Pro are not affected.
- NOTE: Some ArcGIS products incorporate PHP example code, however customers would need to deploy their own PHP service infrastructure for the code to execute – It is the PHP service infrastructure the customer would need to update with PHP updates, not Esri’s components.
If an ArcGIS product is impacted, additional information will be added here.
Commenting is not enabled for this article.