PHP vulnerabilities
GlobaLeaks is not affected

On October 21, 2026, the PHP project published a security advisory about two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

We confirm that neither the GlobaLeaks software nor the infrastructure operated by Whistleblowing Solutions Impresa Sociale is affected by these vulnerabilities.

The GlobaLeaks project and Whistleblowing Solutions recognize the great value of PHP. It has enabled countless people and organizations to build open-source software that serves civil society. Some time ago, however, we retired every PHP component in favor of other languages. For years we have also limited our exposure through VPNs and corporate intranets, to prevent and respond to large-scale vulnerabilities like this one.

GlobaLeaks users and Whistleblowing Solutions customers therefore do not need to take any action.