Vendor reports: operationalOpen · vendor status “monitoring”Official status API

Security Bulletin: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

Reported by Everbridge · Communication & Messaging · source last read 4 min ago

Official source (opens in a new tab)
Vendor start
Oct 22, 2026, 13:47 UTC
Vendor's clock
Resolved
Not yet
Still open
First seen by Statuswall
Nov 11, 2026, 02:11 UTC
Statuswall's clock
Duration
Not available
Needs both vendor times

Summary

Built from the facts below, no AI

Potential impact, not a confirmed outage of your systems.

What the vendor confirmed

  • Everbridge reports operational: "Security Bulletin: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619".[E1, E2]
  • It is not resolved yet (vendor status "monitoring").[E3, E7]

What is unknown

  • Which regions are affected: the vendor did not say.[E5]
  • Which components are affected: the vendor did not say.[E6]
  • Whether your own systems are affected: a vendor report cannot tell you; check your monitoring.
  • When it will be resolved: no estimate is shown unless the vendor publishes one on its page.

Last update in these facts: 2026-11-11 02:11 UTC · summary s1, evidence 363cbd2292782172

Evidence (8)
  1. E1Everbridge reports operational. (vendor) source (opens in a new tab)
  2. E2Vendor title: "Security Bulletin: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619". (vendor) source (opens in a new tab)
  3. E3Vendor status word: "monitoring". (vendor) source (opens in a new tab)
  4. E4Vendor-reported start: 2026-10-22 13:47 UTC. (vendor) source (opens in a new tab)
  5. E5The vendor did not state which regions are affected. (Statuswall)
  6. E6The vendor attached no components. (Statuswall)
  7. E7Not resolved by the vendor yet. (vendor) source (opens in a new tab)
  8. E8First seen by Statuswall: 2026-11-11 02:11 UTC. (Statuswall)

Affected scope

Not stated by the vendor

Components: not stated by the vendor

No region Statuswall recognises is stated for this incident (place names and provider-specific codes are not converted). It is not assumed to be global.

Potential relevance

Everbridge is not in your stack. Follow it to see whether reports like this fall inside the regions you use.

What to check on your side

Verification steps only. Statuswall cannot see your systems.

  • Check message and call delivery rates, and delivery-receipt callbacks.
  • Check queued or retried sends.
  • Check error rates, latency and timeouts in your own monitoring for requests that depend on Everbridge.
  • Look at synthetic checks and alerts that exercise Everbridge.
  • Compare with recent deploys on your side, so a coincidental change is not blamed on the vendor.
  • Follow the vendor's official incident page for scope changes and resolution.

Timeline

Vendor times come from the vendor. “Seen by Statuswall” times are when Statuswall noticed a change, which can lag the vendor by a few minutes. Statuswall does not store the vendor's update text; read it on the official page.

  1. Oct 22, 2026, 13:47 UTCVendor-reported startVendor time
  2. Nov 11, 2026, 02:11 UTCFirst seen by Statuswall (vendor status: monitoring)Seen by Statuswall