October 23, 2026

 

Thank you for your continued trust and support.

 

We are writing regarding the critical PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 / CVE-2026-109619). The National Cybersecurity Office (NCO) and IPA have called for prompt action on these vulnerabilities. We understand that many organizations are now reviewing their systems, and we would like to share the status of Liferay-based environments so that you can proceed with peace of mind.

 

Liferay is built on Java and does not use PHP. Therefore, your Liferay platform is not affected by these vulnerabilities, and no action is required on the platform itself.

 

However, as the authorities have advised, PHP may be used in other parts of your web environment, such as other websites, plugins, customizations, or third-party components that are outside of Liferay. We recommend including these in your review.

 

If you have any questions about your Liferay environment, or if you would like support in reviewing any of your other projects, please do not hesitate to contact us through a support ticket or to your Customer Success contact. Our team is ready to assist you.

 

We will continue to monitor the situation closely and will inform you promptly of any new information relevant to you.