We have patched our core services to the fixed versions released by the PHP project to address CVE-2026-109618 and CVE-2026-109619 as well as applied mitigating controls. We are continuing to monitor the situation and validating that remediation is complete.
We found no evidence that customer data was accessed or that the Qualtrics platform was affected.
Posted Oct 22, 2026 - 02:53 UTC
Update
Status: Mitigation in place, remediation in progress
Mitigations in place Qualtrics is actively applying updates across all potentially affected infrastructure and has deployed mitigation controls. Our security operations team continues to monitor our environment for any suspicious activity. We will share further updates as additional information becomes available.
Posted Oct 21, 2026 - 18:51 UTC
Identified
The PHP project has announced critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP. A security release addressing these issues was published today, October 21, 2026. Proof-of-concept exploits have been published, and security researchers have reported exploitation in the wild.
What we're doing Our security and engineering teams are treating this as a top priority. We are rolling out the patched PHP version across the affected services in our environment, and we are monitoring for suspicious activity while updates are in progress.
Customer impact At this time, we have no evidence that customer data has been accessed or that the Qualtrics platform has been affected.
What you need to do No action is required from customers at this time.