Guidewire is aware of CVE-2026-109618 and CVE-2026-109619, two vulnerabilities affecting PHP that were publicly disclosed on October 21, 2026.  No action is required from customers at this time for their deployments.  We will continue to monitor our systems.  Please refer to Guidewire Community for more information. https://community.guidewire.com/customers/s/article/Guidewire-Security-Remediation-Update-PHP-Vulnerability-CVE-2026-109618-and-CVE-2026-109619

Guidewire is aware of the recently disclosed vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP that were made public on October 21, 2026. Investigation of impact is currently in progress. We will provide customers with additional updates and guidance as our investigation continues. Guidewire is handling these issues with the utmost priority. We currently have no evidence of any compromise of our systems or customer data.