Status: No Impact / Confirmed Non-Vulnerable
On October 21, 2026, the PHP development group disclosed two critical vulnerabilities affecting core PHP runtimes: CVE-2026-109618 (memory corruption via out-of-memory handling) and CVE-2026-109619 (use-after-free via stale request state).
Following an internal security review across our software architectures, deployment pipelines, and cloud services, we confirm that none of our products (Media Shuttle, Jet, Reach Engine, Media Engine, and Flight Deck), cloud platforms, or hosted infrastructure are affected by these vulnerabilities.
Technical Scope & Impact Analysis
| System / Component | Status | Technical Details |
| SaaS & Cloud Services | Not Affected | Signiant core application runtimes do not utilize PHP. All backend services, microservices, and serverless compute operate on non-PHP environments. |
| On-Premise & Hybrid Endpoints | Not Affected | Installed software agents, command-line utilities, and core transfer/processing engines do not package, bundle, or require PHP runtimes or interpreters. |
| API Gateways & Integrations | Not Affected | Authentication proxies, external API gateways, and web services are built entirely outside the PHP execution stack. |
| Internal Development & Tooling | Remediated / Verified | Internal workflows and CI/CD pipelines have been audited to ensure no dependent sidecar tools or build containers expose unpatched PHP runtimes. |
Customer Action Required
No action is required on your part regarding our software or hosted environments.
Customers running independent third-party web servers or custom portal integrations that rely on PHP outside our product scope are encouraged to apply upstream vendor patches (PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+) directly within their own hosting environments.