PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: Bynder product status

Summary

We assessed our products for exposure to the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution.

Status by product

  • Bynder (core DAM platform): Not affected. The platform does not use PHP, so it is out of scope for these vulnerabilities. No action required.
  • Content Workflow: Remediated. PHP has been updated to the latest version, which includes the fix.
  • Webdam: Remediated. PHP has been updated to a version that is not affected by these vulnerabilities.

Compromise assessment

We have found no evidence of compromise in our environment. We continue to monitor.

Contact

For questions, contact your Customer Success Manager.

Updated