Posted: Thursday, October 22, 2026, 15:20 JST

On October 21, 2026 (JST), the PHP developers disclosed two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619).

1. Use of PHP

The core Peatix service does not use PHP. This covers the systems behind event pages, ticket sales and payments, and account management.

PHP is used only on some marketing landing pages (WordPress), which are run separately from the core Peatix service. These pages run in an environment isolated from the core service and do not handle any personal information of our customers or attendees.

2. Our Response

We have confirmed that our hosting provider has applied the patched version released by the PHP developers to these landing pages.

Organizers and attendees using Peatix do not need to take any action.

We will keep monitoring vulnerability information, respond promptly, and work to provide a safe and secure service.