News

Security update: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Published October 21, 2026

On October 20, 2026, the PHP project announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting most PHP versions in use today. Fixed releases were published on October 21, 2026 at 14:00 UTC.

IBANAPI was fully patched on October 21, within an hour of the fix being released. We found no sign of compromise, and no action is needed on your side.

What this means for you

  • The IBANAPI validation API was not affected. Our API is a separate service, written in Go and shipped as compiled code. It does not use PHP, so these vulnerabilities do not apply to it. Your integrations kept running normally throughout.
  • Self-Hosted IBANAPI was not affected. It is built on the same compiled service and does not include PHP.
  • Our website (ibanapi.com) has been updated. The public website and customer account area run on PHP. They were updated to the fixed PHP release on October 21, 2026, and verified straight after.

What we did

  • Applied the official fixed PHP release to our website as soon as it was available.
  • Removed unused software components to further reduce our attack surface.
  • Carried out a forensic review of our servers, covering access logs, application and file integrity, system activity, and account access. We found no sign of exploitation or unauthorized access.
  • Continue to monitor our systems closely, as we do every day.

Your data and API keys

We have no evidence that any customer data, account details, or API keys were accessed. You do not need to change your password or rotate your API keys because of this issue.

Timeline

  • October 20, 2026: The PHP project publishes an advance security notice.
  • October 21, 2026, 14:00 UTC: Fixed PHP versions are released.
  • October 21, 2026: ibanapi.com is updated to the fixed release and verified.
  • October 21, 2026: Our forensic review is completed with no findings.

If you run PHP yourself

If your own systems use PHP, we recommend upgrading to one of the fixed releases as soon as possible: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP 8.1 and older no longer receive security fixes. See the official PHP announcement for details.

Questions

Security is a core part of how we run IBANAPI. If you have any questions about this notice, contact us at [email protected] and we will be glad to help.