The Calibrae LMS platform uses PHP to deliver its service to learners and administrators around the world. In response to the widespread reports of recently discovered vulnerabilities in PHP, we reassure our customers and partners that:
1. On the day the notification of an upcoming security advisory was posted (the 20th of Oct 2026), we implemented the recommended configuration remediations
2. When the advisory was released the following day (the 21st of Oct) it came with PHP updates that patched the problems. As soon as the updates were available, Calibrae patched all platform systems to use the updated version of PHP.
All of our systems have been updated. There is no evidence to suggest that Calibrae received any malicious traffic that leveraged these attack surfaces.
A more detailed breakdown is as follows:
On October 20th, the PHP Security team posted a notification that advised of an important security advisory that was to be published the following day at 14:00 UTC (see: https://www.php.net/archive/2026.php#2026-10-21-5). That day (the 20th), we implemented the platform remediations that were recommended at the time. While the exact nature of the security issue was not known at that point, there were indications that it resolved around exploits that deliberately used failed file uploads to introduce malicious payloads to application servers. Vendors using PHP were encouraged to lock down a number of configuration settings in this area - recommendations that we implemented in a timely manner on the 20th.
The following day, the details for 2 CVEs (CVE-2026-109618 and CVE-2026-109619) were published (see https://php.net). The PHP foundation also published updated source code and binaries that fully patched the discovered problems and made clear that configuration changes did not close all attack surfaces described by the CVEs. Within a few minutes of the PHP updates being published by the PHP foundation, Calibrae began working on deploying the PHP updates to the platform. The platform was fully patched a short while later that same day.
We continue to actively monitor the situation. To date, there is no evidence suggesting that Calibrae has been subject of any attack seeking to use these exploits.
For more information, please contact cto@calibrae.com.
