PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): Kaseya status - Investigation and Remediation

Incident Report for Kaseya Inc

Investigating

Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available.

This page is the source of truth for Kaseya status and guidance.

Product Status:
All products: Customer action: none
Kaseya corporate infrastructure: Customer action: none
Third-party components in Kaseya products: Customer action: none

Posted Oct 21, 2026 - 17:51 EDT