Security Advisory: PHP and BIND 9 Vulnerabilities (October 2026)

Protecting your students, staff, and data is at the core of Securly's mission. When a global security issue could affect the digital safety systems you rely on, we will prioritize taking necessary action and providing transparency.

Overview

This week, two significant security advisories were published that affect widely used internet infrastructure:

• PHP: On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP security advisory for October 21, 2026). Both carry a CVSS severity score of 9.2 and could allow an unauthenticated attacker to execute code on servers running affected versions of PHP. These vulnerabilities affect PHP installations broadly across the industry.

• BIND 9 (DNS): Also on October 21, 2026, the Internet Systems Consortium disclosed CVE-2026-94300 (ISC advisory for CVE-2026-94300), a high-severity vulnerability (CVSS 8.1) in the BIND 9 DNS server that could allow an attacker to crash affected DNS servers and, under certain conditions, execute code on them.

What this means for Securly

PHP

PHP supports a number of our legacy systems. As soon as the advisory was published, our security and engineering teams began identifying every affected server in our environment. We successfully applied the patched PHP releases across all affected systems and are confident that our environment is protected against these vulnerabilities. Our teams continue to monitor closely for any new developments.

DNS

Securly is not affected by the BIND 9 vulnerability. Our DNS infrastructure runs on Unbound, a separate DNS resolver that does not use BIND 9 code. No action was required.

What you need to do

No customer action is required. Securly services continue to operate normally.