Regarding the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) disclosed by the PHP Development Team on October 21, 2026, we would like to inform you about their impact on our services and websites.

• We have confirmed that Soracom is not affected by these vulnerabilities.
• For some of the systems operated by our company where the use of PHP was confirmed, we have completed the necessary measures against the vulnerabilities.

At this time, no action is required from our customers regarding these vulnerabilities, and there are no plans to suspend our service functions. However, if you are using PHP in systems managed by yourselves (such as data transfer destination servers for Soracom Beam, Funnel, etc.), please consider updating to the fixed versions provided by the PHP Development Team.

If you have any questions regarding this matter, please contact Soracom Support.