Bentley ID: BE-2026-0006
CVE IDs: CVE-2026-109618, CVE-2026-109619
Severity: 9.2 (CVSS v4.0)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Published: October 22, 2026

Summary
Bentley is investigating potential impact and deploying fixes where necessary.

Details
On 21 October, the PHP Foundation published a security advisory for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Each has a CVSS score of 9.2 out of 10. According to the advisory, these vulnerabilities can allow unauthenticated remote code execution. An attacker could execute malicious code without needing to log in. PHP is a programming language commonly used to build websites and web applications. Bentley is investigating whether these vulnerabilities affect its products and services. It is deploying security fixes where necessary. The PHP Foundation strongly encourages all PHP users to update their installations to the latest security-patched version for their PHP release branch: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, PHP 8.2.35. Bentley will update this bulletin as more information becomes available.

Mitigations
Bentley will update this bulletin as more information becomes available.

Acknowledgments
We would like to thank and acknowledge lcfr-hax, sagitzadik-wiz, tomash-areion and amyb-oai for the responsible disclosure.

Revision History