New Relic

New Relic PHP Agent / customer PHP runtime

Response status

Agent not vulnerable; PHP update required

Response information checked

2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides application monitoring and observability.

NR26-10 states that New Relic services are unaffected and the vulnerable component is the customer's PHP runtime, not the agent.

Scope: No action for New Relic services does not remove customer PHP patching requirements. Agent-only updates are insufficient.

What users should do

Patch PHP; check agent compatibility when changing PHP branches and verify monitoring after restart.

Official service URL

• https://newrelic.com/

Source URLs

1. https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr26-10/https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr26-10/Response evidence
2. New Relic PHP agent compatibility requirementshttps://docs.newrelic.com/docs/apm/agents/php-agent/getting-started/php-agent-compatibility-requirements/Service and operation documentation