No impact incident

Zapier: Assessment of recently reported PHP vulnerabilities

Current status of Zapier: Partial outage — live Zapier status

Timeline

1. Oct 22, 2026, 14:02 UTC
   investigating
   We have not identified customer impact related to the PHP vulnerabilities reported on October 21, 2026. Our security and engineering teams are reviewing potential exposure **in** NodeJS services and across Zapier. The assessment is ongoing. We will share further findings here as they are confirmed. Please reach out to our [Support team](https://zapier.com/app/get-help "Support team") if you need any help in the meantime.
2. Oct 22, 2026, 14:46 UTC
   resolved
   Our investigation into the reported PHP vulnerabilities is complete. We found no impact on Zapier services or customer data. This advisory is now closed. **Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)** > **1. What is this issue?** > Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can lead to remote code execution under certain conditions. They affect PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. > > **2. Is Zapier affected?** > Our investigation is complete, and we found no impact on Zapier services or customer data. > > **3. Has customer data been affected?** > No. Our investigation found no impact to customer data. > > **4. Does this affect the Zapier WordPress integration for example?** > The Zapier WordPress plugin itself is not vulnerable. WordPress sites run on PHP, though, so site owners should make sure their PHP version is patched (see question 1 for the affected versions). > > **5. Could PHP applications I host be affected?** > Possibly. Applications you run yourself, including on third-party hosting platforms, may be vulnerable if they run an affected PHP version, regardless of Zapier. We recommend updating to a patched PHP version.

Updates as published by Zapier.