Skip to content
OutageDeck

Incident detail

PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images

Active incidentMinor

Timeline window

Started

Get alerted the next time Astronomer breaks

Free email alerts for the handful of vendors you cannot afford to miss. No card, live in about a minute. Paid plans add Slack, Teams, Discord, and webhook delivery across your whole stack, plus higher API quotas.

Set up free alertsHow Astronomer alerts work

Timeline

Incident updates

Every update on the official status source, oldest to newest, exactly as it appeared there.

  1. Monitoring

    **PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

    ** Astronomer has conducted a thorough internal review of its code and container images and confirmed that Astro and Astro Private Cloud do not include PHP and are therefore not affected by the recently disclosed PHP vulnerabilities.

    Customer action: Customers should review their own code and any modifications they have made to Astronomer-provided runtime images (for example, custom-installed packages or system dependencies) to determine whether PHP is present and whether they may be impacted. Please follow the guidance in the NCSC advisory and the PHP project’s security update to remediate any affected components.

Keep exploring

More from Astronomer

Neighboring incidents on Astronomer's timeline and the rest of their record on OutageDeck.

← Older incident

Security Update: Runtime Releases and Guidance for the eMudhra/emSign Certificate Issue

All Astronomer incidentsAstronomer live status