Identified - Pulseway is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.
CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers.
CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution.
Pulseway has completed an evaluation of its product portfolio regarding these vulnerabilities. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information.
Here is what each status means:
Fully Patched: The fix has been applied.
Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate.
Unaffected: The product is not affected by these vulnerabilities.
Product Status:
Pulseway - Fully Patched
Software Catalog - Unaffected
Oct 23, 2026 - 16:27 EDT
CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers.
CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution.
Pulseway has completed an evaluation of its product portfolio regarding these vulnerabilities. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information.
Here is what each status means:
Fully Patched: The fix has been applied.
Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate.
Unaffected: The product is not affected by these vulnerabilities.
Product Status:
Pulseway - Fully Patched
Software Catalog - Unaffected
Oct 23, 2026 - 16:27 EDT
Investigating - Two critical vulnerabilities in PHP that allow unauthenticated remote code execution have been identified.
The Pulseway security teams are assessing all systems and products and applying fixes as they become available.
Oct 22, 2026 - 09:19 EDT
The Pulseway security teams are assessing all systems and products and applying fixes as they become available.
Oct 22, 2026 - 09:19 EDT
Integration Services
Operational
SaaS - United States
Operational
SaaS - Europe
Operational
Remote Control - United States
Operational
License Management
Operational
Remote Control - Europe
Operational
Pulseway PSA
Operational
Software Catalog
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.