No impact incident

Alloy: Security Advisory Notice: Alloy Unaffected by Reported PHP Vulnerabilities

Current status of Alloy: Operational — live Alloy status

Timeline

1. Oct 22, 2026, 16:30 UTC
   investigating
   Alloy's products and services do not use PHP or have any PHP dependencies. Alloy has proactively reviewed all systems and confirmed we are unaffected by PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. AWS, Alloy's infrastructure provider, has also confirmed in their security bulletin 2026-143-AWS that its services are not impacted by these issues.
2. Oct 22, 2026, 16:31 UTC
   monitoring
   Alloy's products and services do not use PHP or have any PHP dependencies. Alloy has proactively reviewed all systems and confirmed we are unaffected by PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. AWS, Alloy's infrastructure provider, has also confirmed in their security bulletin 2026-143-AWS that its services are not impacted by these issues.

Updates as published by Alloy (original).