PHP Vulnerability Responses by Company

Northern.tech

Global cloud / infrastructure
Aliases / services
Northern.tech / northern.tech / Northern.tech AS / CFEngine / Mender / Alvaldi / cfengine.com / mender.io
Official website
https://northern.tech/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

CFEngine Enterprise Hub

Response status
Fixed releases available
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

3.24.6 and3.27.3 include PHP fixes; Hub is treated as affected.

Scope: Availability does not mean customer installation.

What users should do

Upgrade the Hub package; temporary access restrictions disable Mission Portal access.

Official service URL

Source URLs

  1. Northern.tech: PHP vulnerability responsehttps://cfengine.com/blog/2026/php-cves-cve-2026-109618-and-cve-2026-109619/Response evidence
  2. https://cfengine.com/blog/2026/cfengine-3-24-6-and-3-27-3-released/https://cfengine.com/blog/2026/cfengine-3-24-6-and-3-27-3-released/Response evidence

CFEngine Community

Response status
Unaffected; no PHP
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Advisory explicitly confirms no PHP.

Scope: Distinct from Enterprise Hub.

What users should do

No PHP remediation needed for this incident.

Source URLs

  1. Northern.tech: PHP vulnerability responsehttps://cfengine.com/blog/2026/php-cves-cve-2026-109618-and-cve-2026-109619/Response evidence

CFEngine Enterprise clients

Response status
Not directly affected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

No PHP, but a compromised Hub can control clients.

Scope: Not an assurance that the Hub is safe.

What users should do

Prioritize Hub remediation; this issue does not require upgrading every client.

Source URLs

  1. Northern.tech: PHP vulnerability responsehttps://cfengine.com/blog/2026/php-cves-cve-2026-109618-and-cve-2026-109619/Response evidence

CFEngine main, documentation and Build sites

Response status
Unaffected; no PHP
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Names cfengine.com, docs.cfengine.com and build.cfengine.com.

Scope: Excludes customer Hubs.

What users should do

No customer action.

Source URLs

  1. Northern.tech: PHP vulnerability responsehttps://cfengine.com/blog/2026/php-cves-cve-2026-109618-and-cve-2026-109619/Response evidence

Mender Client, Server/Backend and Hosted Mender

Response status
Unaffected; no PHP
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

October22 product advisory confirms no PHP in these components.

Scope: The PHP documentation site is separate.

What users should do

No incident-specific product update.

Source URLs

  1. Mender: PHP vulnerability responsehttps://mender.io/blog/clarifications-regarding-recent-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence

Mender documentation (docs.mender.io)

Response status
Patched
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Upgraded PHP8.3.35 to8.3.36 around06:00 UTC+2 on October22.

Scope: Infrastructure separate from Hosted Mender production.

What users should do

Browse normally.

Source URLs

  1. Mender: PHP vulnerability responsehttps://mender.io/blog/clarifications-regarding-recent-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence

Alvaldi product, website and documentation

Response status
Unaffected; no PHP
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Northern.tech explicitly covers all three scopes.

Scope: Separate from CFEngine Hub.

What users should do

No customer action.

Source URLs

  1. Northern.tech: Alvaldi and related productshttps://northern.tech/careers/blog/clarifications-regarding-recent-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence

northern.tech, devicechronicle.com and mender.io

Response status
Unaffected; no PHP
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Official notices identify non-PHP HubSpot sites.

Scope: Separate from PHP-based Mender documentation.

What users should do

No visitor action.

Source URLs

  1. Northern.tech: Alvaldi and related productshttps://northern.tech/careers/blog/clarifications-regarding-recent-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence
  2. Mender: PHP vulnerability responsehttps://mender.io/blog/clarifications-regarding-recent-php-vulnerabilities-cve-2026-109618-cve-2026-109619Response evidence
Related official sources
  1. Northern.tech: PHP vulnerability responseOfficial notice
  2. Mender: PHP vulnerability responseOfficial notice
  3. Northern.tech: Alvaldi and related productsOfficial notice
  4. Northern.tech: operating-company informationOfficial information directory

Comments