Skip to main content

Search

Welcome to Tibero GTS!

⚠️[Security Notice] Tibero Impact Regarding PHP Security Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Hello, this is Tibero.

We have received ongoing inquiries regarding whether Tibero products are affected by the recent PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619). We are providing the results of our research institute's review below.

 

1. Vulnerability Overview

The vulnerability information identified based on KISA's “PHP Product Security Update Advisory” is as follows.

  • CVE-2026-109618: Improper Handling of Exceptional Conditions vulnerability in PHP
  • CVE-2026-109619: Use After Free vulnerability in PHP

The affected versions and remediated versions are as follows.

  • PHP 8.2: Earlier than 8.2.35 → 8.2.35 or later
  • PHP 8.3: Earlier than 8.3.36 → 8.3.36 or later
  • PHP 8.4: Earlier than 8.4.27 → 8.4.27 or later
  • PHP 8.5: Earlier than 8.5.12 → 8.5.12 or later

※ PHP versions 8.1 and earlier are no longer officially supported for security updates. Upgrading to a supported version is recommended.

 

2. Results of the Tibero Impact Review

The results of our research institute's review are as follows.

  • These vulnerabilities occur in the PHP language itself (PHP core).
  • Tibero clients (such as tbOCI) were confirmed to not be directly affected by these CVEs.
  • Therefore, it has been determined that no separate security patch for Tibero products is required for these vulnerabilities.