Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

i2 Group is aware of the recently disclosed critical security vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities have been reported as potentially allowing unauthorised remote code execution in affected systems.

Following an assessment by our technical and security teams, we can confirm that i2 products are not affected by these vulnerabilities.

No customer action is required in relation to these vulnerabilities for i2 products.

We are also monitoring the potential impact of these vulnerabilities on our third-party service providers.

Where any associated security risks or service disruptions are identified that may affect our customers, we will assess the impact and communicate relevant information and any required actions through appropriate channels.

We remain committed to maintaining the security and integrity of our solutions and continue to monitor emerging security threats and vulnerabilities as part of our ongoing security practices.
Customers requiring further information or technical assurance are encouraged to contact i2 Support.

Reference: PHP Security Advisory