We updated the Adal Cloud public website as soon as the PHP security fixes became available on October 21, 2026. The website now runs PHP 8.5.12. The release addresses CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow unauthenticated remote code execution.
For clarity on where we use PHP: it powers our public website, which runs as a separate application in its own container. Our customer dashboard is built with React. The services that receive, process, and deliver webhooks are written in Go.
That separation defines where PHP sits in our architecture. Running it in a container does not remove vulnerabilities in the runtime itself, which is why applying the update was essential.
For technical details and the list of patched releases, see the PHP team’s security advisory.