October 24, 2026
On October 21, 2026, the PHP Group announced two critical vulnerabilities in the PHP runtime engine (CVE-2026-109618 and CVE-2026-109619), each rated 9.2 under CVSS v4.0.
Immediately after publication of the critical PHP vulnerabilities, we began a review process to quickly determine any impact on Cloud Software Group products, while concurrently conducting a review of company infrastructure and services to identify remediation actions.
Below is a summary of our findings by product group, based on our investigation to date.
NetScaler: Citrix NetScaler ADC and Citrix NetScaler Gateway are affected. We recommend that customers immediately follow our published mitigation guidance.
- Security Advisory: Affected products and mitigation guidance
- Blog: Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619
As noted in our blog article referenced above, we plan to release fixes to address these two PHP memory safety vulnerabilities for all supported NetScaler software versions on October 27, 2026.
Citrix (exclusive of NetScaler): No customer action required.
TIBCO: TIBCO Fulfillment Provisioning is affected. We are preparing a remediation, which is expected to be a patch delivered as either a hotfix or a service pack, to be explained in a Knowledge Base article, and will notify customers directly. Based on our investigation to date, other TIBCO products are not affected.
Arctera: Based on our investigation to date, the Arctera products are not affected. (Based on our investigation to date, Backup Exec is also not affected.)
InfoScale: Based on our investigation to date, the InfoScale products are not affected.
Enterprise Vault: Based on our investigation to date, the Enterprise Vault products are not affected.
Spotfire: Based on our investigation to date, Spotfire products are not affected.
IBI: Based on our investigation to date, IBI products are not affected.
ON EBX: Based on our investigation to date, EBX products are not affected.
DataSynapse: Based on our investigation to date, DataSynapse products are not affected.
Cloud Software Group Infrastructure and Services
Our CSIRT teams have prioritized and remediated our internet-facing systems, and we are continuing to remediate remaining systems based on risk.
What you should do
Customers with questions or who need help applying an applicable mitigation can contact support [https://www.cloud.com/trust-center/support].
To receive notifications about updates and fixes, please subscribe to the advisories published by our business units [https://www.cloud.com/trust-center/product-security/security-advisories]. We will update this post as our investigation continues.
Kumar Palaniappan
Chief Information and Product Security Officer
Cloud Software Group
This information reflects our understanding as of the time of publication and may change as we learn more.
The information on this page is being provided to you on an "AS IS" and "AS-AVAILABLE" basis. The issues described on this page may or may not impact your system(s). Cloud Software Group Holdings, Inc. and its affiliates, including Citrix Systems, Inc. (collectively, "Cloud SG") make no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. BY ACCESSING THIS PAGE, YOU ACKNOWLEDGE THAT CLOUD SG SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. Cloud SG reserves the right to change or update the information on this page at any time. Cloud SG accordingly recommends that you always view the latest version of this page. The information contained herein is being provided to you under the terms of your applicable customer agreement with Cloud SG, and may be used only for the purposes contemplated by such agreement. If you do not have such an agreement with Cloud SG, this information is provided under the cloud.com Terms of Use, and may be used only for the purposes contemplated by such Terms of Use.